Edit tour

Windows Analysis Report
8ue90oYkrv.exe

Overview

General Information

Sample name:	8ue90oYkrv.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
Analysis ID:	1408892
MD5:	5a0d2bc66c17c640e81233cf6a200e07
SHA1:	65ab84dc66feb7b7034ec5713b68fd39a6cd1a01
SHA256:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	49
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

.NET source code contains potential unpacker

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates Visual Basic Runtime Dlls

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: Use Short Name Path in Command Line

Stores large binary data to the registry

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

8ue90oYkrv.exe (PID: 5244 cmdline: C:\Users\user\Desktop\8ue90oYkrv.exe MD5: 5A0D2BC66C17C640E81233CF6A200E07)

TDService.exe (PID: 3624 cmdline: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="" MD5: A94A3D60FA8A54AB71ABED39D5883D86)

TechkonDriver64Bit.exe (PID: 6352 cmdline: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s MD5: F6CD94DEAEA55BB414650D6A9CB7DD6C)

TechkonDriver64Bit.exe (PID: 3292 cmdline: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="" MD5: 5A3DA2206BD35C381B826FF748093684)

cmd.exe (PID: 6056 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

certutil.exe (PID: 7112 cmdline: certutil -f -addstore TrustedPublisher TK1.cer MD5: F17616EC0522FC5633151F7CAA278CAA)

certutil.exe (PID: 904 cmdline: certutil -f -addstore TrustedPublisher TK2.cer MD5: F17616EC0522FC5633151F7CAA278CAA)

x64DPInst.exe (PID: 1172 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 4140 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 5448 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 3836 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 1240 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 5880 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 5836 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 4724 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

msiexec.exe (PID: 2952 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1776 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F1FA5532D1DD3919F4D531B46B734EEE MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5576 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5148 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2924 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3652 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 12FD986294DFC1E2D717A71E276F9E78 MD5: 9D09DC1EDA745A5F87553048E57620CF)

TDService.exe (PID: 892 cmdline: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe" MD5: F00223A56D3F89627CC88625DBCB0C42)

svchost.exe (PID: 1500 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 5792 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.inf" "9" "439f12f93" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "c:\progra~1\techko~1\techko~1\dens" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5284 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "00000000000000D8" "WinSta0\Default" "0000000000000174" "208" "c:\progra~1\techko~1\techko~1\mf-ir" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5700 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000198" "WinSta0\Default" "00000000000001A4" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5284 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.inf" "9" "4b5792527" "00000000000001A8" "WinSta0\Default" "00000000000001A0" "208" "c:\progra~1\techko~1\techko~1\spectr~4" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5876 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.inf" "9" "40b9ce367" "00000000000001C8" "WinSta0\Default" "00000000000001CC" "208" "c:\progra~1\techko~1\techko~1\spectr~3" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5040 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.inf" "9" "48bc6c0e7" "00000000000001CC" "WinSta0\Default" "0000000000000198" "208" "c:\progra~1\techko~1\techko~1\spectr~2" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 4832 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.inf" "9" "46d73562f" "00000000000001E8" "WinSta0\Default" "00000000000001EC" "208" "c:\progra~1\techko~1\techko~1\spectr~1" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 5408 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.inf" "9" "4c691d78b" "00000000000001D4" "WinSta0\Default" "00000000000001D8" "208" "c:\progra~1\techko~1\techko~1\spc171~1" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\mia595B.tmp\TDService.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.2039012583.0000000000401000.00000020.00000001.01000000.00000004.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.TDService.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, CommandLine: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 2952, ParentProcessName: msiexec.exe, ProcessCommandLine: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, ProcessId: 5576, ProcessName: msiexec.exe

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", CommandLine: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\ProgramData\mia595B.tmp\TDService.exe, NewProcessName: C:\ProgramData\mia595B.tmp\TDService.exe, OriginalFileName: C:\ProgramData\mia595B.tmp\TDService.exe, ParentCommandLine: C:\Users\user\Desktop\8ue90oYkrv.exe, ParentImage: C:\Users\user\Desktop\8ue90oYkrv.exe, ParentProcessId: 5244, ParentProcessName: 8ue90oYkrv.exe, ProcessCommandLine: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", ProcessId: 3624, ProcessName: TDService.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", CommandLine: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, NewProcessName: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, OriginalFileName: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, ParentCommandLine: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s, ParentImage: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe, ParentProcessId: 6352, ParentProcessName: TechkonDriver64Bit.exe, ProcessCommandLine: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", ProcessId: 3292, ProcessName: TechkonDriver64Bit.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 1500, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Virustotal: Detection: 9%			Perma Link
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Virustotal: Detection: 8%			Perma Link

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8ue90oYkrv.exe

Joe Sandbox ML: detected

Compliance

Uses 32bit PE files

Source: 8ue90oYkrv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Jump to behavior

PE / OLE file has a valid certificate

Source: 8ue90oYkrv.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb0eNe @e_CorExeMainmscoree.dll source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb,NNN @N_CorDllMainmscoree.dll source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, 00000010.00000002.2208938740.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000010.00000000.2160181246.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000000.2212920742.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000002.2247850295.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 0000001F.00000000.2497378544.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: w:\_thesycon\usb\usbio\_main\bin\fre\amd64\usbio_x64.pdb source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.000000000311F000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, 00000010.00000003.2179903592.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2185360967.000001BEB9B90000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190820569.000001BEB9BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, x64DPInst.exe, 00000010.00000002.2208938740.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000010.00000000.2160181246.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000000.2212920742.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000002.2247850295.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 0000001F.00000000.2497378544.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: gacutlrc.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00407AC0 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	0_2_00407AC0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC72A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	2_2_6CC72A30
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC62470 FindClose,FindFirstFileW,FindFirstFileW,	2_2_6CC62470
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E2A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	10_2_693E2A30
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693D2470 FindClose,FindFirstFileW,FindFirstFileW,	10_2_693D2470

Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Source: TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP
Source: TDService.exe, 00000002.00000003.2613953321.000000000297B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.TECHKON.COM/MICROSOFT
Source: drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl
Source: drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl$
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crlj
Source: drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com
Source: drvinst.exe, 00000012.00000003.2195942001.000001BEB9B8D000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f%2Btw%2FGc
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: drvinst.exe, 00000012.00000003.2195942001.000001BEB9B42000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.comhttp://crl.thawte.com/ThawteTimestampingCA.crl
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sawebservice.red-gate.com/
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2008/schema.xsd
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2196676021.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2196676021.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crlaH7#
Source: drvinst.exe, 00000012.00000003.2195942001.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2196676021.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crlra
Source: drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9BB9000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2196676021.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: drvinst.exe, 00000012.00000003.2195942001.000001BEB9B8D000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com1.3.6.1.5.5.7.48.2http://ts-aia.ws.symantec.com/tss-ca-g2.cer
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/
Source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/InstallAware
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/buydirect.aspopen
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/x2/
Source: 8ue90oYkrv.exe, 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000002.2610568433.0000000000440000.00000002.00000001.01000000.0000000D.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2148764092.0000000003206000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2121119719.000000007FE3A000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000000.2117973572.000000000095B000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.installaware.comz
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2613953321.00000000029A8000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TECHKON
Source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2148764092.000000000318C000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2121119719.000000007F940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zip
Source: TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zipiJu
Source: TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zipn
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_me
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/L
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/UploadReport2
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
Source: TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002804000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.techkon.com/
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2613953321.000000000297B000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.techkon.com/Microsoft

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\B06B5044\C2555B5\spectrojet_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA96F.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE1E4.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\1ABF3862\DFC33D3E\spectrodens_x64.cat	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\7AA455DC\9C4070E9\dens_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7C9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\4D56F533\BD12AE78\spectrodens_ir_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET16FE.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF64.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET19EC.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB844.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\52B152B3\9B44F18F\spectrodrive_x64.cat	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\56A7DD7A\5EDECBEE\spectrojet_x64.cat	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\9E7D6EA9\A1D4A3D9\TK2.cer	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC94B.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B08.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET30FE.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\849003A2\CFFA0AE5\spectroplate_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E10.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET347.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\F2F92670\383AE05B\spectrodrive_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC583.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB68E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\66E41FEB\A1D4A3D9\TK1.cer	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET94ED.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SET9DF.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.cat (copy)	Jump to dropped file

System Summary

Abnormal high CPU Usage

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Process Stats: CPU usage > 49%

Creates Visual Basic Runtime Dlls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior

Creates driver files

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys

Jump to behavior

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a91.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BBA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C57.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{CD1E6019-47AE-4334-A91E-595BA68B6E06}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C97.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CC7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CF7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a95.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a95.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a96.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8830.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88BE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{55EA8940-B618-47BD-A642-20BFB2A64F78}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88FE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI891E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI897D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a99.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5c6a99.msi	Jump to behavior
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Windows\DPINST.LOG
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\dens_x64.inf_amd64_0443b10bbf7d32a7
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodens_ir_x64.inf_amd64_8d12fea260853771
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem5.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectroplate_x64.inf_amd64_c71201b931dd1be0
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem6.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrojet_x64.inf_amd64_5ffa68417e0a7d5b
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem7.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodrive_x64.inf_amd64_4202c4b809e7c711
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem8.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodrive_x64.inf_amd64_2098370fcaa48685
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem9.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodens_x64.inf_amd64_f8d6912081a30de7
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem10.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrojet_x64.inf_amd64_8d9b062068cda5fb
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem11.inf

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI6BBA.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0041F2D0	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0040AEE0	0_2_0040AEE0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00401000	0_2_00401000
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00401100	0_2_00401100
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004011C0	0_2_004011C0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004011D8	0_2_004011D8
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004042D0	0_2_004042D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004102D0	0_2_004102D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004013F0	0_2_004013F0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0040E440	0_2_0040E440
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0042244E	0_2_0042244E
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00405510	0_2_00405510
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004045A0	0_2_004045A0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004015B0	0_2_004015B0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00403760	0_2_00403760
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004128A0	0_2_004128A0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0040D900	0_2_0040D900
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00401AB0	0_2_00401AB0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00408DD0	0_2_00408DD0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0040EFF0	0_2_0040EFF0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC64C00	2_2_6CC64C00
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC5AE70	2_2_6CC5AE70
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC58AB0	2_2_6CC58AB0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC56460	2_2_6CC56460
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC635F0	2_2_6CC635F0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC6FEE0	2_2_6CC6FEE0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC78E1B	2_2_6CC78E1B
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC6B9C0	2_2_6CC6B9C0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC6E950	2_2_6CC6E950
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC5B447	2_2_6CC5B447
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC7E6B0	2_2_6CC7E6B0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC5E670	2_2_6CC5E670
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC7E78B	2_2_6CC7E78B
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC5D1B0	2_2_6CC5D1B0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10001000	10_2_10001000
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10009028	10_2_10009028
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10017330	10_2_10017330
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_100153E0	10_2_100153E0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1000D450	10_2_1000D450
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001E5C3	10_2_1001E5C3
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10017710	10_2_10017710
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001E751	10_2_1001E751
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1000E770	10_2_1000E770
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_100127E0	10_2_100127E0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001E82B	10_2_1001E82B
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_100178D0	10_2_100178D0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1000C8E0	10_2_1000C8E0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10014A40	10_2_10014A40
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1000EB10	10_2_1000EB10
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1000CCA0	10_2_1000CCA0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001AD1A	10_2_1001AD1A
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10016D80	10_2_10016D80
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10017DC0	10_2_10017DC0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10012F00	10_2_10012F00
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10016F80	10_2_10016F80
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693C8AB0	10_2_693C8AB0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693D4C00	10_2_693D4C00
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693CAE70	10_2_693CAE70
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693D35F0	10_2_693D35F0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693C6460	10_2_693C6460
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693DE950	10_2_693DE950
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693DB9C0	10_2_693DB9C0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E8E1B	10_2_693E8E1B
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693DFEE0	10_2_693DFEE0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693CD1B0	10_2_693CD1B0
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693CB447	10_2_693CB447
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693EE78B	10_2_693EE78B
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693CE670	10_2_693CE670
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693EE6B0	10_2_693EE6B0

Enables security privileges

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: String function: 6CC54C80 appears 39 times
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: String function: 6CC77AA4 appears 37 times
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: String function: 693C4C80 appears 39 times
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: String function: 10018EB0 appears 95 times
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: String function: 693E7AA4 appears 37 times
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: String function: 00422A14 appears 35 times

PE file contains executable resources (Code or Archives)

Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: mia.lib.0.dr	Static PE information: Resource name: RC_DATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

PE file does not import any functions

Source: stdole2.tlb.0.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameADVPACK.DLLx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003FB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003FB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF16.DLL5%ProductNameMicrosoft vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003FB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF32.DLLj% vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003B30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelcms.dll vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.000000000405E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOLEPRO32.DLL( vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServiceConnection.dlld" vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedzncore.dll vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedznet.dllD vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUSBIOCOM.dllT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomcat.dllx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServerApp.exed" vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003FFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDSCON.ocx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_.dll4 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamez vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServiceLogMonitor.exeX vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTechkonSpectroDriveUpdate.exeT vs 8ue90oYkrv.exe

Tries to load missing DLLs

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usbiocom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: netfxperf.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: version.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: mpr.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: winmm.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: winsta.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: olepro32.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: wldp.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: propsys.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: profapi.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: srclient.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: spp.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: powrprof.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: vssapi.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: vsstrace.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: msi.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: srpapi.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: wkscli.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: netutils.dll
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll

Uses 32bit PE files

Source: 8ue90oYkrv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TechkonSpectroJetUpdate.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDServerApp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDService.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDService.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TechkonSpectroDriveUpdate.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: TechkonSpectroJetUpdate.exe.0.dr, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TechkonSpectroJetUpdate.exe.0.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TechkonSpectroJetUpdate.exe.0.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDServerApp.exe.0.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TDServerApp.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDServerApp.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDService.exe.0.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TDService.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDService.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal45.evad.winEXE@59/343@0/0

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 0_2_0041E6A0 GetVersion,CoCreateInstance,

0_2_0041E6A0

Source: C:\ProgramData\mia595B.tmp\TDService.exe

Code function: 2_2_6CC72980 LoadResource,SizeofResource,LockResource,CreateFileW,WriteFile,FindCloseChangeNotification,DeleteFileW,

2_2_6CC72980

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\TECHKON GmbH

Jump to behavior

Source: C:\ProgramData\mia595B.tmp\TDService.exe

File created: C:\Users\user\AppData\Local\IIIQF

Jump to behavior

Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DPINST_LOG_SCROLLER_MUTEX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Mutant created: NULL
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Mutant created: \BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\ProgramData\mia595B.tmp\TDService.exe

File created: C:\Users\user\AppData\Local\Temp\lang.loc

Jump to behavior

Source: Yara match	File source: 2.0.TDService.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2039012583.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\mia595B.tmp\TDService.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe, type: DROPPED

Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: y`	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: "-k=	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: "/k=	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: -k=	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: /k=	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Title	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: BeginPrompt	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Progress	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Directory	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: RunProgram	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: ExecuteFile	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: @KA	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: setup.exe	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: %%T	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: %%T\	0_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: mia.lib	0_2_0041F2D0

Source: 8ue90oYkrv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\ProgramData\mia595B.tmp\TDService.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\mia595B.tmp\TDService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: x64DPInst.exe	String found in binary or memory: Some post-install cleanup tasks failed. Error code is 0x%X
Source: x64DPInst.exe	String found in binary or memory: Could not re-add '%s' to reference list of driver store entry '%s'
Source: x64DPInst.exe	String found in binary or memory: Successfully re-added '%s' to reference list of driver store entry '%s'
Source: x64DPInst.exe	String found in binary or memory: Install option set: Suppress pre-install of Plug and Play drivers if no matching devices are present.
Source: x64DPInst.exe	String found in binary or memory: Error 0x%X - Could not delete service info key for '%ws', even though there are no more DIFx-installed driver stores using this se
Source: x64DPInst.exe	String found in binary or memory: During undo of install, we failed to re-install the driver. Error code 0x%X

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

File read: C:\Users\user\Desktop\8ue90oYkrv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8ue90oYkrv.exe C:\Users\user\Desktop\8ue90oYkrv.exe
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process created: C:\ProgramData\mia595B.tmp\TDService.exe .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F1FA5532D1DD3919F4D531B46B734EEE
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX
Source: unknown	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe"
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process created: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 12FD986294DFC1E2D717A71E276F9E78
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.inf" "9" "439f12f93" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "c:\progra~1\techko~1\techko~1\dens"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "00000000000000D8" "WinSta0\Default" "0000000000000174" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000198" "WinSta0\Default" "00000000000001A4" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.inf" "9" "40b9ce367" "00000000000001C8" "WinSta0\Default" "00000000000001CC" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.inf" "9" "48bc6c0e7" "00000000000001CC" "WinSta0\Default" "0000000000000198" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.inf" "9" "46d73562f" "00000000000001E8" "WinSta0\Default" "00000000000001EC" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.inf" "9" "4c691d78b" "00000000000001D4" "WinSta0\Default" "00000000000001D8" "208" "c:\progra~1\techko~1\techko~1\spc171~1"
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process created: C:\ProgramData\mia595B.tmp\TDService.exe .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F1FA5532D1DD3919F4D531B46B734EEE	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 12FD986294DFC1E2D717A71E276F9E78	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process created: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.inf" "9" "439f12f93" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "c:\progra~1\techko~1\techko~1\dens"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "00000000000000D8" "WinSta0\Default" "0000000000000174" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000198" "WinSta0\Default" "00000000000001A4" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "00000000000000D8" "WinSta0\Default" "0000000000000174" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.inf" "9" "40b9ce367" "00000000000001C8" "WinSta0\Default" "00000000000001CC" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.inf" "9" "48bc6c0e7" "00000000000001CC" "WinSta0\Default" "0000000000000198" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.inf" "9" "46d73562f" "00000000000001E8" "WinSta0\Default" "00000000000001EC" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.inf" "9" "4c691d78b" "00000000000001D4" "WinSta0\Default" "00000000000001D8" "208" "c:\progra~1\techko~1\techko~1\spc171~1"

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\ProgramData\mia595B.tmp\TDService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Jump to behavior

PE / OLE file has a valid certificate

Source: 8ue90oYkrv.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: 8ue90oYkrv.exe

Static file information: File size 13453632 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb0eNe @e_CorExeMainmscoree.dll source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb,NNN @N_CorDllMainmscoree.dll source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000003F79000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, 00000010.00000002.2208938740.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000010.00000000.2160181246.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000000.2212920742.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000002.2247850295.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 0000001F.00000000.2497378544.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: w:\_thesycon\usb\usbio\_main\bin\fre\amd64\usbio_x64.pdb source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.000000000311F000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, 00000010.00000003.2179903592.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2185360967.000001BEB9B90000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190820569.000001BEB9BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe, x64DPInst.exe, 00000010.00000002.2208938740.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000010.00000000.2160181246.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000000.2212920742.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 00000014.00000002.2247850295.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, x64DPInst.exe, 0000001F.00000000.2497378544.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: gacutlrc.pdb source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: TechkonSpectroJetUpdate.exe.0.dr, AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly.Load(byte[])
Source: TDServerApp.exe.0.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TDService.exe.0.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TDService.exe0.0.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TechkonSpectroDriveUpdate.exe.0.dr, AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly.Load(byte[])

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 0_2_00425561 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00425561

PE file contains an invalid checksum

Source: TDService.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x127b7b
Source: TDService.exe1.0.dr	Static PE information: real checksum: 0x0 should be: 0x519d69
Source: mMSIExec.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x16af1f
Source: dzncore.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3f85f
Source: stdole2.tlb.0.dr	Static PE information: real checksum: 0x0 should be: 0x52af
Source: mia.lib.0.dr	Static PE information: real checksum: 0x78abd should be: 0xa3ca7
Source: TDServiceLogMonitor.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x11f04
Source: TechkonSpectroDriveUpdate.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ba8a4
Source: lcms.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x35ee6
Source: TDServerApp.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x132619
Source: TDService.exe0.0.dr	Static PE information: real checksum: 0x0 should be: 0x127b7b
Source: TechkonSpectroJetUpdate.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xe77a0
Source: mVBExec.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x14f360

PE file contains sections with non-standard names

Source: mMSIExec.dll.0.dr	Static PE information: section name: .didata
Source: msvbvm60.dll.0.dr	Static PE information: section name: ENGINE
Source: mVBExec.dll.0.dr	Static PE information: section name: .didata
Source: TDService.exe1.0.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004300F8 push eax; retf	0_2_00430145
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_0043368D pushad ; retf 0002h	0_2_00433699
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00422A59 push ecx; ret	0_2_00422A6C
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00434BC8 push eax; retn 0042h	0_2_00434BC9
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC77AE9 push ecx; ret	2_2_6CC77AFC
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10013130 push ecx; mov dword ptr [esp], ecx	10_2_10013131
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001D2C0 push eax; ret	10_2_1001D2EE
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_10018EB0 push eax; ret	10_2_10018ECE
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E7AE9 push ecx; ret	10_2_693E7AFC

Source: TechkonSpectroJetUpdate.exe.0.dr	Static PE information: section name: .text entropy: 7.8810776452765055
Source: TDServerApp.exe.0.dr	Static PE information: section name: .text entropy: 7.851236452154908
Source: TDService.exe.0.dr	Static PE information: section name: .text entropy: 7.950881957105219
Source: TDService.exe0.0.dr	Static PE information: section name: .text entropy: 7.950881957105219
Source: TechkonSpectroDriveUpdate.exe.0.dr	Static PE information: section name: .text entropy: 7.905714785753008

Persistence and Installation Behavior

Drops PE files

Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7EA.tmp	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\TDService.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8830.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SETA2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET173E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C57.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI891E.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA9B0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC9AB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88BE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BBA.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET57C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E51.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET951E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\mia.lib	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF85.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET313F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CC7.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB6BF.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET1A7B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88FE.tmp	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB875.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE215.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C97.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC5B3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 5c6a94.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.sys (copy)	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\TDService.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET1A7B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88FE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8830.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC9AB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB875.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SETA2F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI88BE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BBA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B38.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI891E.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET313F.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA9B0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CC7.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE215.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C97.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.sys (copy)	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\mia595B.tmp\mia.lib	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\mia7B89.tmp\mia.lib	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file

Boot Survival

Creates or modifies windows services

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\TDServiceLog

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Stores large binary data to the registry

Source: C:\Windows\System32\drvinst.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 1050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 17D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 37D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Window / User API: threadDelayed 700			Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Window / User API: threadDelayed 8427			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7EA.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8830.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E51.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SETA2F.tmp	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET951E.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET173E.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF85.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6C57.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B38.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI891E.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET313F.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA9B0.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6CC7.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB6BF.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET1A7B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI88FE.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC9AB.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB875.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI88BE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6BBA.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\mia7B89.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET57C.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE215.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6C97.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC5B3.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.sys (copy)	Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-18727
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-18824

Found large amount of non-executed APIs

Source: C:\ProgramData\mia595B.tmp\TDService.exe	API coverage: 8.4 %
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	API coverage: 9.0 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6204	Thread sleep count: 700 > 30	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6204	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 1576	Thread sleep count: 137 > 30	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6204	Thread sleep count: 8427 > 30	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6204	Thread sleep time: -8427000s >= -30000s	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe TID: 1084	Thread sleep time: -32656s >= -30000s

Queries keyboard layouts

Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00407AC0 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	0_2_00407AC0
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC72A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	2_2_6CC72A30
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC62470 FindClose,FindFirstFileW,FindFirstFileW,	2_2_6CC62470
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E2A30 _memset,FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	10_2_693E2A30
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693D2470 FindClose,FindFirstFileW,FindFirstFileW,	10_2_693D2470

Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe

Code function: 10_2_10001B41 GetSystemInfo,

10_2_10001B41

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\mia595B.tmp\TDService.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\ProgramData\mia595B.tmp\TDService.exe	API call chain: ExitProcess graph end node			graph_2-23098
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	API call chain: ExitProcess graph end node			graph_10-37089

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 0_2_00423B3C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00423B3C

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

0_2_00425561

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_004240E4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004240E4
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00424945 SetUnhandledExceptionFilter,	0_2_00424945
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00423B3C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00423B3C
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 0_2_00420DEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00420DEF
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC76CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CC76CD8
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC75A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CC75A8A
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: 2_2_6CC751C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CC751C7
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001B723 SetUnhandledExceptionFilter,	10_2_1001B723
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_1001B735 SetUnhandledExceptionFilter,	10_2_1001B735
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E5A8A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_693E5A8A
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E6CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_693E6CD8
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: 10_2_693E51C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_693E51C7

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\ProgramData\mia595B.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer

Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProgmanU
Source: 8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: GetLocaleInfoA,	0_2_004295EA
Source: C:\ProgramData\mia595B.tmp\TDService.exe	Code function: GetLocaleInfoA,	2_2_6CC7DEDB
Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe	Code function: GetLocaleInfoA,	10_2_693EDEDB

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.cat VolumeInformation

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 0_2_004250BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004250BC

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 0_2_0041F2D0 MessageBoxW,CoInitialize,_memset,GetVersionExW,GetCommandLineW,_malloc,__CxxThrowException@8,MessageBoxW,_malloc,__CxxThrowException@8,MessageBoxW,MessageBoxW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateProcessW,GetLastError,CloseHandle,WaitForSingleObject,GetExitCodeProcess,FindCloseChangeNotification,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_0041F2D0

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Windows\System32\certutil.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B6E6CB217307F0D3CD5CA360D368887B8FA98BA3 Blob

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	21 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	21 Windows Service	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	46 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	43 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
8ue90oYkrv.exe	4%	ReversingLabs
8ue90oYkrv.exe	1%	Virustotal	Browse
8ue90oYkrv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	100%	Joe Sandbox ML
C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	100%	Joe Sandbox ML
C:\ProgramData\mia595B.tmp\TDService.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	100%	Joe Sandbox ML
5c6a94.rbf (copy)	2%	ReversingLabs
5c6a94.rbf (copy)	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	2%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	2%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	1%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	10%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	5%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	8%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\TDService.exe	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	2%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe	2%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx	0%	ReversingLabs
C:\ProgramData\mia595B.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.smartassembly.com/webservices/Reporting/L	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TECHKON	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/UploadReport2	0%	Avira URL Cloud	safe
http://ocsp.thawte.comhttp://crl.thawte.com/ThawteTimestampingCA.crl	0%	Avira URL Cloud	safe
http://www.installaware.comz	0%	Avira URL Cloud	safe
http://www.installaware.com/	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TechkonDriver64Bit.7zipiJu	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/L	1%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/UploadReport2	0%	Virustotal		Browse
http://www.techkon.com/Microsoft	0%	Avira URL Cloud	safe
HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TECHKON	0%	Virustotal		Browse
http://www.mywebsite.com/TechkonDriver64Bit.7zipn	0%	Avira URL Cloud	safe
http://www.installaware.com/buydirect.aspopen	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	0%	Virustotal		Browse
http://www.installaware.com/	0%	Virustotal		Browse
http://www.installaware.com/InstallAware	0%	Avira URL Cloud	safe
HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP	1%	Virustotal		Browse
http://www.techkon.com/	0%	Avira URL Cloud	safe
http://www.techkon.com/Microsoft	0%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/	0%	Avira URL Cloud	safe
http://www.installaware.com/x2/	0%	Avira URL Cloud	safe
http://www.installaware.com/buydirect.aspopen	1%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/	0%	Virustotal		Browse
http://www.installaware.com/x2/	1%	Virustotal		Browse
http://www.techkon.com/	0%	Virustotal		Browse
http://www.installaware.com/InstallAware	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mywebsite.com/TECHKON	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2613953321.00000000029A8000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F940000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.smartassembly.com/webservices/Reporting/L	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sawebservice.red-gate.com/	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2008/schema.xsd	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.smartassembly.com/webservices/Reporting/UploadReport2	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.comhttp://crl.thawte.com/ThawteTimestampingCA.crl	drvinst.exe, 00000012.00000003.2195942001.000001BEB9B42000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198866038.000001BEB9B42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.comz	8ue90oYkrv.exe, 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039562862.00000000007FF000.00000002.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000002.2610568433.0000000000440000.00000002.00000001.01000000.0000000D.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2148764092.0000000003206000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2121119719.000000007FE3A000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000000.2117973572.000000000095B000.00000002.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_me	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.installaware.com/	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.0000000000418000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mywebsite.com/TechkonDriver64Bit.7zipiJu	TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.techkon.com/Microsoft	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2613953321.000000000297B000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2097703170.0000000005051000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007F940000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP	TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mywebsite.com/TechkonDriver64Bit.7zipn	TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002754000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crlj	drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com	drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000003302000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2195942001.000001BEB9BE2000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BD3000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000002.2198821613.000001BEB9B05000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000012.00000003.2190859904.000001BEB9BE4000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000015.00000003.2222410790.000001CF288AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl$	drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.installaware.com/buydirect.aspopen	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
HTTP://WWW.TECHKON.COM/MICROSOFT	TDService.exe, 00000002.00000003.2613953321.000000000297B000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.installaware.com/InstallAware	TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.techkon.com/	TechkonDriver64Bit.exe, 0000000A.00000003.2600608486.0000000002804000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mywebsite.com/TechkonDriver64Bit.7zip	TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2148764092.000000000318C000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000A.00000003.2121119719.000000007F940000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.smartassembly.com/webservices/UploadReportLogin/	8ue90oYkrv.exe, 00000000.00000003.2035416907.0000000002A36000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.installaware.com/x2/	8ue90oYkrv.exe, 00000000.00000003.2035416907.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000002.00000000.2039012583.000000000077E000.00000020.00000001.01000000.00000004.sdmp, TDService.exe, 00000002.00000003.2043556777.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 00000009.00000003.2115091440.0000000002D6D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl	drvinst.exe, 00000012.00000003.2190983896.000001BEB9BC8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408892
Start date and time:	2024-03-14 12:12:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8ue90oYkrv.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
Detection:	MAL
Classification:	mal45.evad.winEXE@59/343@0/0
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 63% Number of executed functions: 155 Number of non-executed functions: 157
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 72.21.81.240, 20.166.126.56, 23.206.121.28, 23.206.121.20, 52.165.164.15
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target TechkonDriver64Bit.exe, PID 6352 because there are no executed function
Execution Graph export aborted for target x64DPInst.exe, PID 1172 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:22	API Interceptor	3599176x Sleep call for process: TDService.exe modified

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Config.Msi\5c6a93.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34382
Entropy (8bit):	5.158756389621352
Encrypted:	false
SSDEEP:	768:CyTwT115cmcDdWW3pv2ltwuNDxTpt7t7t7t7t7t7t7t7t6t7tdt7txJr7zSvi8Sc:VTo115cmcDdWW3pv2ltwuNDWI
MD5:	8F9B946A436E48D4C80ED812D5B2211F
SHA1:	B6B46C51803DE72C966AE34131939A7ADEA8B2D2
SHA-256:	A6FF54CB0E1A171305455DF89FE698243F75DBD90A56B3C4C0673776971C0E37
SHA-512:	6087D455CC12944755C29BF43C56629A60653C465ED83A425F2606E5DB5C95F0B0B404C513A365E7B335DA6C12F71B2FE22BBF0BFB398D02E1D04690B7743F05
Malicious:	false
Preview:	...@IXOS.@.....@.anX.@.....@.....@.....@.....@.....@......&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}..TECHKON Device Service..TDService.msi.@.....@.....@.....@........\PROGRA~3\&.{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Service......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{CD0C69EF-2B12-47ED-87B7-5A1DB20CBCD9}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{4D6F449F-FA68-42B5-A305-16C45F308B8F}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{96ED6BF5-4AA1-4668-AEEE-E5101CDF29BA}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{672A692B-629D-4B2A-A63B-2E211EA7164C}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{877EEC96-C1A3-45AB-B6E1-782150290E44}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{C166FAF3-5D3D-41C9-B181-43DF2464FB59}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{1E484634-B892-4CBA-9690-0E

C:\Config.Msi\5c6a98.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	46696
Entropy (8bit):	5.127122725660687
Encrypted:	false
SSDEEP:	768:f9Lc5CLgpPGZvWs5idXxqlcsS8/4r/RmBkE/l/83tOtatNtWtdtAtstSthtkt7tr:1Lc5CLgpPGZvWs5idXxqlcsS8/4r/Rmx
MD5:	4948A45A621BBC100C76D2A409BEEBA7
SHA1:	682107DD4AFD596EE4001F98CD1F3EA3E9252434
SHA-256:	B9481B573E294F4D0DF5A6C2CB588810333B129652B6F72F64199F9C5174F037
SHA-512:	335E4BBCE700D78887CFC86D653FAB279871D81ADF6769CD4E88C500AF757C1DC4DA4FCCB78C46796AEB534A932D62AB2354ADA18A1D65173DBB66058DC665F2
Malicious:	false
Preview:	...@IXOS.@.....@.anX.@.....@.....@.....@.....@.....@......&.{55EA8940-B618-47BD-A642-20BFB2A64F78}..TECHKON Device Driver 64Bit..TechkonDriver64Bit.msi.@.....@.....@.....@........\PROGRA~3\&.{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Driver 64Bit......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{5702EAC5-033D-48B5-B83F-DEF9ECF4C262}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{52B0046B-434A-4EA9-9AC7-766C93D4D3F6}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{6D03A36D-9750-4B1E-8344-0CE7ACED2DE2}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{2B8BCB22-4191-4BD5-817D-B0123E06B87F}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{2CBD538B-C017-439A-8339-57F7ED6A8246}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{CDF804F9-6941-49E0-8B67-519B61E33E8A}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{DB88E18

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2871552
Entropy (8bit):	7.91890094076526
Encrypted:	false
SSDEEP:	49152:NnnZhJegT3345UB8r/fecnYWgPmGWy0tGGDOYEHamRS1j1fC5j9IXvWm6BPX:5nZygT33wtr/fmZxWywGGDOBxRkj1f6x
MD5:	3A0BF599146750C008BA6960C694470D
SHA1:	22E869B8C60BBFB263A7AF2B5350386617EB6E72
SHA-256:	3F1DC61B0BF0B93B1CD5478F151895B357DA92CAD2A48857E2FC4645C41E2DA3
SHA-512:	5E6ED7829C8DC1879C67FF6F142A96575251C583A5AE9103A48587BFF42C463B59B5EAB7F543414838AEA4E5BBCA6C0F8433CE3BEF6367632B663F242DF7D30F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@...................................+......................................`......................+. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2902256
Entropy (8bit):	7.920111663334885
Encrypted:	false
SSDEEP:	49152:ynnZhJevas/0bxZjXAqySgkyneVSTTHJ7Als2GT/R1OPS5R+dQ:4nZA2xZjXgkAMSH24t1L5R+dQ
MD5:	F6CD94DEAEA55BB414650D6A9CB7DD6C
SHA1:	06AC62B0283E0490C9F66D3DE1E5CA47866CA3AA
SHA-256:	08F2DBAF4537368977DC0F0790F1FFF6FD65D30F4C91FED2B2CACC9A7F307A07
SHA-512:	3688F2622F43570DC1BD53B027D9A6C57FDE7DD4A34697D2E283549CF780F789A033FAA6EF5AB20EA49551921AC71844407AAAD0EDC87F9AAC9D1C2413D58F2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@..................................$-......................................`....................../,. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	7.783380196730505
Encrypted:	false
SSDEEP:	24576:vF2oerN+CFfmxlJHLjyyrRyx/tCA1Q49UMEEXEimWZ2Eoxch6YB4:Mz9FOLjyywxNbrEEXhFoxch3
MD5:	0B682718F2229F8526387698D1F60DAF
SHA1:	FD7A024C14B1874587B1C6F94ED8AE4BA55C385C
SHA-256:	2491D1F5D96A265794972F7BAB6173005B300BC1E85ACDA346E882D6DEBB366A
SHA-512:	2D3B801A91C92DEC134AB0A81D7CFD2ADDA1045FD0A706B2605CB3046BEB19D97DD49D4A1418CA4966EDAE91A6CDB10A21379B85E1C035C20FB1FCE14851E597
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W.....................`......\|.... ........@.. .......................`............@.................................2...J.......P@...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...P@.......P..................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	4.824855858394781
Encrypted:	false
SSDEEP:	24:cPN97KgwMV+nCGgMSqX+nH1WqBN3kmugmC4mA0snxs5XFF:cPr7/wdCGgXHH1Wqfi5mA0sxsvF
MD5:	83B25C1067C9BE0BCDF289BBED80D363
SHA1:	25FABE1F042D90F5678C3F97FCA6260BF27619D5
SHA-256:	1AB2F18023EE11A92E4A3D5D7F5A9FB9A8ED8D69D93D8D804CCCEB1E431A2442
SHA-512:	FCA4C27E0FDEAD9537694168AEA7DF3F2A05FB8E05F3EA8ECC6241E8A16A801532C9F71C777AC16528747D2160B1C9B5898CB5B8AF6C751509BE296F0CF280C0
Malicious:	false
Preview:	.<configuration>...<configSections>....<section name="log4net" type="System.Configuration.IgnoreSectionHandler" />...</configSections>...<runtime>...</runtime>...<log4net>....<appender name="TraceAppender" type="log4net.Appender.TraceAppender">.....<layout type="log4net.Layout.PatternLayout">......<conversionPattern value="%date [%thread] %-5level- %message%newline" />.....</layout>....</appender>.. .. <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="TDServiceLog.txt" />.. <appendToFile value="true" />.. <rollingStyle value="Size" />.. <maxSizeRollBackups value="10" />.. <maximumFileSize value="100KB" />.. <staticLogFileName value="true" />.. <threshold value="INFO"/>.. <lockingModel type="log4net.Appender.FileAppender+MinimalLock" />.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.368242915265491
Encrypted:	false
SSDEEP:	192:kRYqGL5n0f1auFrzr9VCj0aWSXRaf4iPH0uTiF7odzFaGFbieHr/zZYZud:37l08kCBZBaf9/BiqzFdFbieHTzZYcd
MD5:	10195658250CA94B280DECCB4997B198
SHA1:	765684257978376B463369065C552366282963F3
SHA-256:	6801FD3462EE096A683D97A65D6E421E8B1419E9EEDC4A47BE7E2A14BCFA2CEF
SHA-512:	016207696A3D7E4D719F3506F5C6F5CF66B77C56226778C328A0A0D6D807D572650CC460A9343276A05F2448BBC16EF0F8DF844BA257ECF8573C48343F6A0B36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..W...........!.....0... ......^N... ...`....@.. ...............................L....@..................................N..W....`..h...........................XM............................................... ............... ..H............text...d.... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9261380700304658
Encrypted:	false
SSDEEP:	384:GJzxPeOGEk4GKz7csqunx2gs1RteTOJ722RELbcAbZtLWs8:EzxNksqaJr2SLIEZ
MD5:	9CFAB4DAACA85482012D97693EA88201
SHA1:	095C31E6257CC5028E4605266477526D3B256B2B
SHA-256:	0EBB561BC5FB6FEB35ADE2BE679AB8149C9942253ADD9A1C2B7A6F53ADFE4E46
SHA-512:	9B6587CE414365420E96CA430C8DE170006CFF9ACEB51E7BF95BBFF6845AA936E8BF35D30B6442D23D48B460A085FA47673959BD3CB996970894549A71B7AB9F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..W.................P...P......^e... ........@.. ....................................@..................................e..S........?..........................\d............................................... ............... ..H............text...dE... ...P.................. ..`.rsrc....?.......@...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.88327202760358
Encrypted:	false
SSDEEP:	49152:8t723QiNn1X9NVWevTX9giFzbmjEanZQTS:8k3QiNnjNVWeLNg6nmj9n
MD5:	819E58177441A1A5EAEE35216DC4B6D7
SHA1:	65306A7FEF4AC738EA7177833B1D966E0B6C0BA5
SHA-256:	2E03F7A87D69FE8B32A0B9604E270A3AF9DD3421351BE230889B7E24F2F6F88C
SHA-512:	D8B7D560364D348ABFD956ACA24EC5631AB7488E3D49C27256B829D4EA165E0C56DC579E2E0EF1209029B7559B16A401AE63CDBBB2C773DAC176D7ABBAA3823A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 10%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. ....................................@.................................h...J.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	7.835247620836694
Encrypted:	false
SSDEEP:	24576:foVuryMKftmxBFAsBnnJO16noCKPxKnp:gVoyMKftoYsFnI1DRPU
MD5:	6E5F4B906BD48CB77E3830F2871F726E
SHA1:	7C070D83CAD9F33D4A9EC01CDE9E0BB3AFE51409
SHA-256:	6DD53DECDE4A70E8B42657FAE088C22C07D8553E59506524ABA608BA087066F1
SHA-512:	616B153C677FE7F403D179664E24AD5FCD6041237A9A2A9FC4CA0A2C8B0050E74AA953E7349EC23780485D7D4984AA5072A8CCA26CDF9BC8439981424CC46C32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 8%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. .......................@............@.................................X...J............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18285
Entropy (8bit):	3.2625513904435572
Encrypted:	false
SSDEEP:	384:Lgxt0XdZ+3rWJr1N684b86fZMaTx111m+0:QiM3Q13A6aN111c
MD5:	1EBA2DF49DE0B85065585C6042C0770B
SHA1:	FE847BFA3FA1DC279BF7FDCB62BC27EFD4306B91
SHA-256:	BD0732871DBEAEE6A3BD9D5D0C5E1A32CB3752A857D203857AE2A99780004232
SHA-512:	17CA2455054057A486EA2D77439CFFCE4AFC4564E99219AAE7BB44DAE0511F552D8DC5C071A8FA01CDE208EE36EADD90600DE9976FC9CA31CE6310FDD448A005
Malicious:	false
Preview:	Remission..16.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..17.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..18.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..19.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..20.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..21.0,212.0,21.0,21.0,211.0,213.0,217.0,22.0,224.0,227.0,228

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	3.6044727088231916
Encrypted:	false
SSDEEP:	96:IPGiqjELGICWPCVo61VAZ1MluVPKEb81H:IPooLGICBVo6Oc
MD5:	55B6DFD4BEE7501D0A45D4BA9A865C06
SHA1:	8D4395E23F830F37FB59FBC8A03D15753E89F65F
SHA-256:	BE03976E9EB14CD5C07E3B7B0C7AD26B637F3AFC765959D080EE91BAD095B513
SHA-512:	63B07E67AAAAAB735967651AD1B3B8FC960F2809C02AF8DADD01BBEA9A722E56AA1C0BF8E95185965B919757DB6B3E5E5EB66CB3ED555416B755142D1D6E89AC
Malicious:	false
Preview:	Remission..Black.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..Cyan.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..Magenta.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..Yellow.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..Black_SD90.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..Black_SD0.0,212.0,21.0,21.0,211.0,213

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.22180183473209
Encrypted:	false
SSDEEP:	6144:WNO7HqL+9Qxpw1Lpaofbn+0u61wxkM2AbuACH9d7jWy:WNO7HJX16uph
MD5:	5D1E5758CEE95AC926D0C9F7C18095EE
SHA1:	8253C41EF9539BDAD5FC15DB4FABA99C23242CD2
SHA-256:	4E48950BB961EA13C4DD489D915D0DF83304D52C950A99E3E6B981EAC22112D9
SHA-512:	B074D0DE952407F5DC721DE7157EC9957A8AD98A9C04F27F04A7BA81B5F0064DEB93F8D370539A4D37598E95B9D1EC5F91B13AFEC26BBA04309138E03F763750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^W...6...6...6..a...6..u)...6.....6..u)..S6.......6..>...6...6..6.......6...0...6.......6..Rich.6..........PE..L.../l.?...........!................9................................................................'..............`...........d...............................x.......................................................x............................text............................... ..`.rdata........... ..................@..@.data....t.......p..................@....rsrc...............................@..@.reloc.. ".......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.191530389320213
Encrypted:	false
SSDEEP:	768:idEKqzhqGRvl2ZTDATBSNdCskYW50dstrF/vmifdXJNs7GGSZhRhudUrvf:idErzhqGNl2dATskYgLhfhC2vf
MD5:	2B3281E100D19123A8E307FBB2DB0939
SHA1:	501376281A00B9B9A90BE2F7DACA3DB87C96DCC0
SHA-256:	24C362E5E8819F46C23DF1D2C36C5343D088293AF4178D9ED8B966296F0BB43E
SHA-512:	3ACB639C1C0AAB53EE9FDCB3E5F9C3767F70536858D96EBEE7841567C7C1C130F5D8DFB6FF6F491B17A56B3D579C2545E8909B3C2EB5D6D5947FEA1D6C15045A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.?...........!......... ........... ........... ....................... ......"...........................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.2832136787344055
Encrypted:	false
SSDEEP:	3:HrJQyogRM/fyAiLJQyogRM/cLGr:HeFT9b
MD5:	C10BB4CF9692695632DE53434201ACA9
SHA1:	4215207F1C5E53C2CBA1638C7B27B587F0E48FC6
SHA-256:	CC11C5FEA0D555905CC67BF2081C55F9F82A049EE65A89A371D2310BF37AA8EB
SHA-512:	27234743327A5F7F46B60CD1F544C77353AA93C29E583EE8A8DB801D5E654EEDB2AAF30F8F4EA4219BB53B739C9E51694143009F9533BB456F0B44F2E2ADC862
Malicious:	false
Preview:	certutil -f -addstore TrustedPublisher TK1.cer..certutil -f -addstore TrustedPublisher TK2.cer..

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.164821094442024
Encrypted:	false
SSDEEP:	24:3hE3IaffyrWghhywWGwBBrG7V+vXx9uyv1jTRgjDiuVz0mkhfAwfSLC:36DffrgarB8V+vXx9uyv0DiuVxkhfEm
MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
SHA1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
SHA-512:	7232D3260D6714B6DD1B403AB1F838E2D6A33F9AA37D50C2DE4328DBFEA450C3A77875A333968219CB4F8B21140559310FBA42C9833F740A928554387EFFD969
Malicious:	false
Preview:	0.._0..G.......,h..g.0L.....1..0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140304000000Z..170602235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........!.`.x..qr.r.....y.....$<.]./..E.EyJ.&4..}....}Y.O..5up....77.B.E,.U..P..b@.T.Ek..mr_9#.?.n..S....^?j....Z....m8.....L+..n...s.....k.......<\|>_.T9.C...u.S}N...3.C.oKqup>..?`,..U.."..p..3<d<..$Q....\|_...`U.(m...f...j....+-.. F`.....[..e\|..g.?5........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....0*0(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.175302981793894
Encrypted:	false
SSDEEP:	24:/3IaffyrW+hywWGwBBrG7pLqQ9xtRgjDiuVz0mkh6fyzjOlJ9X2I0:/DffrJrB80mgDiuVxkh6fyzSx0
MD5:	1E256F3CD8A847D91596BF2C37DBF285
SHA1:	6641ED279EF1A7A8E6D06BCEB38570B429101AA2
SHA-256:	6FCE0715E8C7D2B5BF2D7B049AE6CB6842E2D9757A2D9296A1587BBD05C2FE25
SHA-512:	91DAD8AFEA4A493269688CA7B7642DA7A663742C5811AADB3EE13D66DCB3BE2B1ED5EA6A9F45FBF9E6E432AEED0A9AE1AAA4A921658F2D5DDF2524C5EF195C3A
Malicious:	false
Preview:	0.._0..G.......7......'@...\...0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...110320000000Z..120307235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........6.....:N~lw..F..J7h...5x._9..\....:.)z..].......g.....4.....D..FI.......s....`L....}..`~.U..E.H....Q........sv.....x.eLh...`..<^.%.. .J.....(5...^.....U.P.....r.......{..u...O..0....V.y......$#...#. N..:...E.L0.CZ..B3.E..@x.?.\|..B.".....&.<.........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....00(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5295078
Entropy (8bit):	6.41595061147608
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJF:hTaRZ8tjD4+wD5ZksyPHIFIF
MD5:	A94A3D60FA8A54AB71ABED39D5883D86
SHA1:	3FC14B383FD699017AA7B7281C28F143AEAF7B9F
SHA-256:	3AC4616A5ABF9A408EDCCC48D15AB9DD6441DAD273C8F477C1EB291812949451
SHA-512:	172CE336A3343D8ED92EDA525A549F1E388D37076F71DC28C043FABC94B04761B7E936871F203C2B681EB4BFCC8C239327656F51003CD46D11C94589B1E8CC13
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\mia595B.tmp\TDService.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\mia595B.tmp\TDService.msi

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\mia595B.tmp\TDService.res

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3831837
Entropy (8bit):	6.288047394335939
Encrypted:	false
SSDEEP:	49152:zXlXDzXmLXrXxXzX4XOXWXmOX+rXAEJD2d8hMcSCnmNPIkFVZ+cocaFjhkSYKPM:xw4BF3ai
MD5:	3EA26D5D84024858345551BDD209F62A
SHA1:	DE89AEAB1CBE1328B0CDB7C17BE2B43BEA076E30
SHA-256:	E58F0C20DFFBB1299D972CC7C3556DDDDE8D6888570FEEF208E48EAD68877149
SHA-512:	5E8F2CCA528F77CC624FD17228D796E3921008A9D73511793E33FE6F4B94463D5304A969A4F18DD0BCDD2C5B0663861570E861DAC58355EF641860BB071AE607
Malicious:	false
Preview:	7z..'.......'p:...............M...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\mia595B.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2902256
Entropy (8bit):	7.920111663334885
Encrypted:	false
SSDEEP:	49152:ynnZhJevas/0bxZjXAqySgkyneVSTTHJ7Als2GT/R1OPS5R+dQ:4nZA2xZjXgkAMSH24t1L5R+dQ
MD5:	F6CD94DEAEA55BB414650D6A9CB7DD6C
SHA1:	06AC62B0283E0490C9F66D3DE1E5CA47866CA3AA
SHA-256:	08F2DBAF4537368977DC0F0790F1FFF6FD65D30F4C91FED2B2CACC9A7F307A07
SHA-512:	3688F2622F43570DC1BD53B027D9A6C57FDE7DD4A34697D2E283549CF780F789A033FAA6EF5AB20EA49551921AC71844407AAAD0EDC87F9AAC9D1C2413D58F2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@..................................$-......................................`....................../,. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.031963137664287
Encrypted:	false
SSDEEP:	3072:LwlZ+P6imnm8mFmT73tgHnV53kAgcvzgRm1trohJkwh:cZ+6imnm8mFmT73krb6gonf
MD5:	CEC1791BEC45F9D86771AF4F24EAA3F4
SHA1:	1B806C9A7189C7801EF643C5AEA03CD6B0DEDCC4
SHA-256:	7878EB862C0A8AB0766236E6C2183FAC93A0C734276347A143B454E2FB8B4F58
SHA-512:	BF917BA4C20DB97685A4BFEA266ECE11C77286F9480E546007FC1D830E4DFBA0966F6B5B59D74AFC89713276BB899755DFABC8F3C42A8422E612401C761A9BE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.v.v.v.Y.v.v.Y.v...v"..v.v"..v.v.vE..v.Y.v..v.Y.v...v.Y.v...v.Y.v...vRich.v........PE..L...Q..K...........!.....`...P...............p......................................[...............................0................0..................................................................@............p..l............................text...._.......`.................. ..`.rdata...x...p.......p..............@..@.data....9....... ..................@....rsrc........0......................@..@.reloc..V'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	7.783380196730505
Encrypted:	false
SSDEEP:	24576:vF2oerN+CFfmxlJHLjyyrRyx/tCA1Q49UMEEXEimWZ2Eoxch6YB4:Mz9FOLjyywxNbrEEXhFoxch3
MD5:	0B682718F2229F8526387698D1F60DAF
SHA1:	FD7A024C14B1874587B1C6F94ED8AE4BA55C385C
SHA-256:	2491D1F5D96A265794972F7BAB6173005B300BC1E85ACDA346E882D6DEBB366A
SHA-512:	2D3B801A91C92DEC134AB0A81D7CFD2ADDA1045FD0A706B2605CB3046BEB19D97DD49D4A1418CA4966EDAE91A6CDB10A21379B85E1C035C20FB1FCE14851E597
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W.....................`......\|.... ........@.. .......................`............@.................................2...J.......P@...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...P@.......P..................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.368242915265491
Encrypted:	false
SSDEEP:	192:kRYqGL5n0f1auFrzr9VCj0aWSXRaf4iPH0uTiF7odzFaGFbieHr/zZYZud:37l08kCBZBaf9/BiqzFdFbieHTzZYcd
MD5:	10195658250CA94B280DECCB4997B198
SHA1:	765684257978376B463369065C552366282963F3
SHA-256:	6801FD3462EE096A683D97A65D6E421E8B1419E9EEDC4A47BE7E2A14BCFA2CEF
SHA-512:	016207696A3D7E4D719F3506F5C6F5CF66B77C56226778C328A0A0D6D807D572650CC460A9343276A05F2448BBC16EF0F8DF844BA257ECF8573C48343F6A0B36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..W...........!.....0... ......^N... ...`....@.. ...............................L....@..................................N..W....`..h...........................XM............................................... ............... ..H............text...d.... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\3CE6DECE\FDA73152\defaultSpot.tss

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	3.6044727088231916
Encrypted:	false
SSDEEP:	96:IPGiqjELGICWPCVo61VAZ1MluVPKEb81H:IPooLGICBVo6Oc
MD5:	55B6DFD4BEE7501D0A45D4BA9A865C06
SHA1:	8D4395E23F830F37FB59FBC8A03D15753E89F65F
SHA-256:	BE03976E9EB14CD5C07E3B7B0C7AD26B637F3AFC765959D080EE91BAD095B513
SHA-512:	63B07E67AAAAAB735967651AD1B3B8FC960F2809C02AF8DADD01BBEA9A722E56AA1C0BF8E95185965B919757DB6B3E5E5EB66CB3ED555416B755142D1D6E89AC
Malicious:	false
Preview:	Remission..Black.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..Cyan.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..Magenta.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..Yellow.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..Black_SD90.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..Black_SD0.0,212.0,21.0,21.0,211.0,213

C:\ProgramData\mia595B.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2871552
Entropy (8bit):	7.91890094076526
Encrypted:	false
SSDEEP:	49152:NnnZhJegT3345UB8r/fecnYWgPmGWy0tGGDOYEHamRS1j1fC5j9IXvWm6BPX:5nZygT33wtr/fmZxWywGGDOBxRkj1f6x
MD5:	3A0BF599146750C008BA6960C694470D
SHA1:	22E869B8C60BBFB263A7AF2B5350386617EB6E72
SHA-256:	3F1DC61B0BF0B93B1CD5478F151895B357DA92CAD2A48857E2FC4645C41E2DA3
SHA-512:	5E6ED7829C8DC1879C67FF6F142A96575251C583A5AE9103A48587BFF42C463B59B5EAB7F543414838AEA4E5BBCA6C0F8433CE3BEF6367632B663F242DF7D30F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@...................................+......................................`......................+. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9261380700304658
Encrypted:	false
SSDEEP:	384:GJzxPeOGEk4GKz7csqunx2gs1RteTOJ722RELbcAbZtLWs8:EzxNksqaJr2SLIEZ
MD5:	9CFAB4DAACA85482012D97693EA88201
SHA1:	095C31E6257CC5028E4605266477526D3B256B2B
SHA-256:	0EBB561BC5FB6FEB35ADE2BE679AB8149C9942253ADD9A1C2B7A6F53ADFE4E46
SHA-512:	9B6587CE414365420E96CA430C8DE170006CFF9ACEB51E7BF95BBFF6845AA936E8BF35D30B6442D23D48B460A085FA47673959BD3CB996970894549A71B7AB9F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..W.................P...P......^e... ........@.. ....................................@..................................e..S........?..........................\d............................................... ............... ..H............text...dE... ...P.................. ..`.rsrc....?.......@...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.88327202760358
Encrypted:	false
SSDEEP:	49152:8t723QiNn1X9NVWevTX9giFzbmjEanZQTS:8k3QiNnjNVWeLNg6nmj9n
MD5:	819E58177441A1A5EAEE35216DC4B6D7
SHA1:	65306A7FEF4AC738EA7177833B1D966E0B6C0BA5
SHA-256:	2E03F7A87D69FE8B32A0B9604E270A3AF9DD3421351BE230889B7E24F2F6F88C
SHA-512:	D8B7D560364D348ABFD956ACA24EC5631AB7488E3D49C27256B829D4EA165E0C56DC579E2E0EF1209029B7559B16A401AE63CDBBB2C773DAC176D7ABBAA3823A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. ....................................@.................................h...J.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.22180183473209
Encrypted:	false
SSDEEP:	6144:WNO7HqL+9Qxpw1Lpaofbn+0u61wxkM2AbuACH9d7jWy:WNO7HJX16uph
MD5:	5D1E5758CEE95AC926D0C9F7C18095EE
SHA1:	8253C41EF9539BDAD5FC15DB4FABA99C23242CD2
SHA-256:	4E48950BB961EA13C4DD489D915D0DF83304D52C950A99E3E6B981EAC22112D9
SHA-512:	B074D0DE952407F5DC721DE7157EC9957A8AD98A9C04F27F04A7BA81B5F0064DEB93F8D370539A4D37598E95B9D1EC5F91B13AFEC26BBA04309138E03F763750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^W...6...6...6..a...6..u)...6.....6..u)..S6.......6..>...6...6..6.......6...0...6.......6..Rich.6..........PE..L.../l.?...........!................9................................................................'..............`...........d...............................x.......................................................x............................text............................... ..`.rdata........... ..................@..@.data....t.......p..................@....rsrc...............................@..@.reloc.. ".......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.4058590918443175
Encrypted:	false
SSDEEP:	6144:U+l+8gbiTF32Cw0oSGWhuLuGser+VbGrIQL:idbgFmJSGWhWuGseapkr
MD5:	05D89328C51E732DE076DA05239D1D79
SHA1:	C89B8500D13D540D9F6D8FA651F13E2F9990DECE
SHA-256:	EE0BC472EC26CE050315AAAE1D85AE51BAF17E8A2A548E3161DED665CF324DD1
SHA-512:	9EFE29F322A0A3049D0E5332C92A434B2F9797C0D3DB09414FCF8D6F5A01C4157716D5D252B38879312D5675712AD875B2A8D7E9407849CE1B992B94D5E50FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9K!3}O`}O`}O`.5D`\|O`.6A``O`.5E`.O`.5\`xO`}N`3O`{.E`iO`.,I`\|O`..K`\|O`Rich}*O`........................PE..L......B...........!.....p..........w...................................................................................W.......<....`.......................p.......................................................................................text....k.......p.................. ..`.rdata...(.......0..................@..@.data...X........`..................@....rsrc........`......................@..@.reloc.......p... ... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.853209211745096
Encrypted:	false
SSDEEP:	1536:YxeYFH0dtYcPdtYc0F9J174KlwOAYQog4wBYo4IYo4N65xpUV:YTFXNxF9j7j65xpUV
MD5:	9AA2C7DEAF5B8DBED62A60F723553858
SHA1:	6BFE53D07A3970523DC8C796EE24F392D2686BF7
SHA-256:	28D0E73EE5616C2A76829A0A430F465B598987B4798F6BA46234393E40167BA9
SHA-512:	AF2C404702563143B3ED6FC26C45D4E1CBB074F006420FF04F963C1F13783CA141C13D08918AFA9537A2DAABABC631C18DBB6562BC50AA3CB49294CCD00714F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......UBq..#...#...#...?...#..^....#..'....#.......#..Rich.#..........PE..L...Y..J...........!.........@......(........................................@......"J..........................................(.......D....................0..............................................X... .......(............................text............................... ..`.data...H...........................@....rsrc...D........ ..................@..@.reloc.......0.......0..............@..B2..H............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	7.835247620836694
Encrypted:	false
SSDEEP:	24576:foVuryMKftmxBFAsBnnJO16noCKPxKnp:gVoyMKftoYsFnI1DRPU
MD5:	6E5F4B906BD48CB77E3830F2871F726E
SHA1:	7C070D83CAD9F33D4A9EC01CDE9E0BB3AFE51409
SHA-256:	6DD53DECDE4A70E8B42657FAE088C22C07D8553E59506524ABA608BA087066F1
SHA-512:	616B153C677FE7F403D179664E24AD5FCD6041237A9A2A9FC4CA0A2C8B0050E74AA953E7349EC23780485D7D4984AA5072A8CCA26CDF9BC8439981424CC46C32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. .......................@............@.................................X...J............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.191530389320213
Encrypted:	false
SSDEEP:	768:idEKqzhqGRvl2ZTDATBSNdCskYW50dstrF/vmifdXJNs7GGSZhRhudUrvf:idErzhqGNl2dATskYgLhfhC2vf
MD5:	2B3281E100D19123A8E307FBB2DB0939
SHA1:	501376281A00B9B9A90BE2F7DACA3DB87C96DCC0
SHA-256:	24C362E5E8819F46C23DF1D2C36C5343D088293AF4178D9ED8B966296F0BB43E
SHA-512:	3ACB639C1C0AAB53EE9FDCB3E5F9C3767F70536858D96EBEE7841567C7C1C130F5D8DFB6FF6F491B17A56B3D579C2545E8909B3C2EB5D6D5947FEA1D6C15045A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.?...........!......... ........... ........... ....................... ......"...........................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\D4D85249\AD5CD7BA\TDService.exe.config

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	4.824855858394781
Encrypted:	false
SSDEEP:	24:cPN97KgwMV+nCGgMSqX+nH1WqBN3kmugmC4mA0snxs5XFF:cPr7/wdCGgXHH1Wqfi5mA0sxsvF
MD5:	83B25C1067C9BE0BCDF289BBED80D363
SHA1:	25FABE1F042D90F5678C3F97FCA6260BF27619D5
SHA-256:	1AB2F18023EE11A92E4A3D5D7F5A9FB9A8ED8D69D93D8D804CCCEB1E431A2442
SHA-512:	FCA4C27E0FDEAD9537694168AEA7DF3F2A05FB8E05F3EA8ECC6241E8A16A801532C9F71C777AC16528747D2160B1C9B5898CB5B8AF6C751509BE296F0CF280C0
Malicious:	false
Preview:	.<configuration>...<configSections>....<section name="log4net" type="System.Configuration.IgnoreSectionHandler" />...</configSections>...<runtime>...</runtime>...<log4net>....<appender name="TraceAppender" type="log4net.Appender.TraceAppender">.....<layout type="log4net.Layout.PatternLayout">......<conversionPattern value="%date [%thread] %-5level- %message%newline" />.....</layout>....</appender>.. .. <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="TDServiceLog.txt" />.. <appendToFile value="true" />.. <rollingStyle value="Size" />.. <maxSizeRollBackups value="10" />.. <maximumFileSize value="100KB" />.. <staticLogFileName value="true" />.. <threshold value="INFO"/>.. <lockingModel type="log4net.Appender.FileAppender+MinimalLock" />.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%

C:\ProgramData\mia595B.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\EDD97940\FDA73152\defaultScan.tss

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18285
Entropy (8bit):	3.2625513904435572
Encrypted:	false
SSDEEP:	384:Lgxt0XdZ+3rWJr1N684b86fZMaTx111m+0:QiM3Q13A6aN111c
MD5:	1EBA2DF49DE0B85065585C6042C0770B
SHA1:	FE847BFA3FA1DC279BF7FDCB62BC27EFD4306B91
SHA-256:	BD0732871DBEAEE6A3BD9D5D0C5E1A32CB3752A857D203857AE2A99780004232
SHA-512:	17CA2455054057A486EA2D77439CFFCE4AFC4564E99219AAE7BB44DAE0511F552D8DC5C071A8FA01CDE208EE36EADD90600DE9976FC9CA31CE6310FDD448A005
Malicious:	false
Preview:	Remission..16.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..17.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..18.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..19.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..20.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..21.0,212.0,21.0,21.0,211.0,213.0,217.0,22.0,224.0,227.0,228

C:\ProgramData\mia595B.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	74960
Entropy (8bit):	6.080943948881524
Encrypted:	false
SSDEEP:	1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
MD5:	81E5C8596A7E4E98117F5C5143293020
SHA1:	45B7FE0989E2DF1B4DFD227F8F3B73B6B7DF9081
SHA-256:	7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
SHA-512:	05B1E9EEF13F7C140EB21F6DCB705EE3AAAFABE94857AA86252AFA4844DE231815078A72E63D43725F6074AA5FEFE765FEB93A6B9CD510EE067291526BB95EC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~c.3...."......#.................3.............p................................g....................................................%.......................... ...8............................................................................text....................... ....... ..`.data...............................@....rsrc....%.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	5.626412274243338
Encrypted:	false
SSDEEP:	48:iuB0q8Z8LCQZ5U45owLkq10Ju1pwZbQP+DWmnDypKGDsQVG:NB0q7L35S22u1pwZC+ymnDmKGDsv
MD5:	7210D5407A2D2F52E851604666403024
SHA1:	242FDE2A7C6A3EFF245F06813A2E1BDCAA9F16D9
SHA-256:	337D2FB5252FC532B7BF67476B5979D158CA2AC589E49C6810E2E1AFEBE296AF
SHA-512:	1755A26FA018429AEA00EBCC786BB41B0D6C4D26D56CD3B88D886B0C0773D863094797334E72D770635ED29B98D4C8C7F0EC717A23A22ADEF705A1CCF46B3F68
Malicious:	false
Preview:	MZR.....................@...............................................!..L.!This program requires Microsoft Windows...$.......NE.<............................1.@.P.\|.....M.............R.......r.P.r.`.r.q.r...........l...0...............p...0..........W95INF16...WEP...DLLENTRYPOINT...........KERNEL.USER.SETUPX....?.z...?.....?.!...INF Installation Library...W95THK_THUNKDATA16.....................................................................EU...WQ.V..j.j.Q......j....f..]M.EU....f..]M....2...v.2...6...:.XZh..h..h>.hV..RP.....w95thk_ThunkData32..U..F..p........U...h ..h...v.f.v..@.I.=....@.........V.^.&....f.v..F..P.........t....M.v...6L...6X......Ph...........u.....P..6d........t..v.......j....F..^.&..3.^.........WV.v..v.V......N.....N.;.v.QVQP........&.?\t..F.&..\G.^.&.? t.......F&.< t..v.W.V.....^_........WV..C.......f....3.........F..F.f.v..F..P............j......P.......u......P.......t..F...j.f.v......3.....~....f.~..u..F......F...3..F.F.F.f+.f.N.f.N.h..h...N..Q......

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	2.9774207313950316
Encrypted:	false
SSDEEP:	48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
MD5:	4BE7661C89897EAA9B28DAE290C3922F
SHA1:	4C9D25195093FEA7C139167F0C5A40E13F3000F2
SHA-256:	E5E9F7C8DBD47134815E155ED1C7B261805EDA6FDDEA6FA4EA78E0E4FB4F7FB5
SHA-512:	2035B0D35A5B72F5EA5D5D0D959E8C36FC7AC37DEF40FA8653C45A49434CBE5E1C73AAF144CBFBEFC5F832E362B63D00FC3157CA8A1627C3C1494C13A308FC7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=2...........!......................... .....p.........................p...................................... .......@..<....P.......................`..0...................................................d@..(............................text............................... ..`.rdata....... ......................@..@.data........0......................@....idata..@....@......................@....rsrc........P......................@....reloc..\....`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\asycfilt.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	147728
Entropy (8bit):	5.909287934496192
Encrypted:	false
SSDEEP:	3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
MD5:	C89E401800DE62E5702E085D898EED20
SHA1:	72FB4F088C6AC02097B55FB267C76FBF5E0FA1F7
SHA-256:	DE83C9D9203050B40C098E4143EF8F577AA90016C7A64D4F2931B57A4C43E566
SHA-512:	70006D70DCB47361FF43E4F7C458655AD2474B70CB917873AA77D2CC06465A68D375D36C494D154A03DBBFF891DF7DD6CAB3D2C7B08E8650B9FF170E30838070
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ru..ru..ru..mf..ru..ru..su.Rich.ru.........................PE..L....!.6...........#..................... ........<e.........................`... ..^q..................................n.......d....0.......................@..0...P!............................................... ..L............................text...n.... ....... .............. ..`.data....d.......P..................@....rsrc........0......................@..@.reloc..v....@... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\comcat.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22288
Entropy (8bit):	4.814478820147639
Encrypted:	false
SSDEEP:	384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
MD5:	3B180DA2B50B954A55FE37AFBA58D428
SHA1:	C2A409311853AD4608418E790621F04155E55000
SHA-256:	96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
SHA-512:	CF94AD749D91169078B8829288A2FC8DE86EC2FE83D89DC27D54D03C73C0DECA66B5D83ABBEAA1FF09D0ACAC4C4352BE6502945B5187ECDE952CBB08037D07E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rD.2....i......#.....2...................P.....w.................................................................?......*<..d....`.......................p..4...............................................X....................................text...#0.......2.......... V...... ..`.data........P.......B..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..BkD.2(.....22...jD.2?....%.2J...........ole32.dll.KERNEL32.dll.USER32.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\mVBExec.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1326592
Entropy (8bit):	6.662178971692568
Encrypted:	false
SSDEEP:	24576:9JGBDZIKwoTaK/T/Tua+hWWfnElT/XhBiSwmK9lHcPJMgh:vqxaSzqUNBXhkSwQPi
MD5:	AC12DEC48405495C2008858D243DA8BC
SHA1:	0B6AD42CDE232A81B415481B772319FB1138C35E
SHA-256:	AD45020E327C16F0A847C38A058E606A7738EA6D0DDAAF80439797CA95F5FD43
SHA-512:	F6A381063DC321C85BD9FFECD524FCFA4EB968AA7644AB339F292B7037BE9C1FA997D2CAD382BE92848010AEEEA38209908B5FAE17CD0B261E0DBEFA38BF5F58
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.....................t.....................Q....................................................................N.......\7.......Z..........................................................................,................................text...\........................... ..`.itext.............................. ..`.data....M.......N..................@....bss.....T...@...........................idata..\7.......8..................@....didata..............P..............@....edata..N............Z..............@..@.rdata...............\..............@..@.reloc...............^..............@..B.rsrc....Z.......Z..................@..@.....................>..............@..@........................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1386496
Entropy (8bit):	6.507253562372704
Encrypted:	false
SSDEEP:	24576:jrWIEO0eDfcPOvCOpMEPJonhql5oHS+zh3JajtObuF+T+NUFRjUgIeX40sgdp:jrOuCQhJohq3oHrh3JajtObu2+NUF5Vd
MD5:	F28EB5CBC3CA6D8C787F09F047D1F9C8
SHA1:	70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5
SHA-256:	3EF32E0152CC3FA07C417E6AADF9EAD83A17B5FDEE73799044E1BD7564725D6E
SHA-512:	84F811F75E9D5143898728D2109B349802A292D4EF2CCAE4B4421D20268A33C6DDEE9C70E8BDEB474A3AC70307B2554C00CE786CA1F446807610FA2717F3745F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#.........v.....................f......................... .......N...............................0...Q..............L.................... .......................................................................................text.............................. ..`ENGINE.............................. ..`.data....n.......p..................@....rsrc...l...........................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\oleaut32.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	598288
Entropy (8bit):	6.644743270512807
Encrypted:	false
SSDEEP:	12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
MD5:	7B156D230278B8C914EF3F4169FEC1CC
SHA1:	6B58E20B2538CB308091DA838710F6AAD933A301
SHA-256:	BAEB2F7C1B8BE56738D34E1D1DDF8E0EEBD3A633215DC1575E14656BE38B939D
SHA-512:	E4EC2BC714069E0A6B56D89B52AABAD92E5BA741DC6F26D2FC2D72AA9AD2EC465DEA523CCCD810331AB78B5FB8A1244B2B521303418EAD5BD6BE5A58B43794C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ibW.-.9.-.9.-.9...7.(.9.{.*.,.9.-.9...9.Rich-.9.................PE..L....#.6...........#..... ...................p....4e......................... ......+................................6..%$.......................................g...................................................................................text............ ... .............. ..`.data....a...0...`...@..............@....rsrc...............................@..@.reloc...g.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\olepro32.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164112
Entropy (8bit):	5.8462943829831575
Encrypted:	false
SSDEEP:	3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
MD5:	CE0155405EA902797E88B92A78443AEB
SHA1:	8ADFF69050D14A57D7F553CA8978439AF188C192
SHA-256:	789C3C45EDA1749BD939F4A96616E1E9EF1B7DCC62A2889F65088954C64D0938
SHA-512:	3FDE09067F9CA8D315DE07C8DB972F99723EA4C3F997DC58210F9D6565CAA9935C79F13E8B2D20ADC5609919A381E4C2A90A0B3123A35947997229D7C615E162
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.'r!.I!!.I!!.I!w.Z!*.I!!.I!\.I!Rich!.I!........PE..L....!.6...........#.................)... ........0_............................. ..>................................................0...3...................p...... #............................................... ...............................text...q.... ....... .............. ..`.data....X.......P..................@....rsrc....3...0...@... ..............@..@.reloc.......p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\stdole2.tlb

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	4.083884450202126
Encrypted:	false
SSDEEP:	384:cogoEvM/uFrR+X6QNn1pcJIrWocDGWct:cogoEvM0rgqQNn3
MD5:	1B02577F0ADDEA32EB02A50D4A4CDD1E
SHA1:	36F701CCEC78A5D218FEA23FD05351890F14CF7D
SHA-256:	6EA525BFACE5467C1045C3708F339A4B92A3A273F70656E061C7F7322C56D667
SHA-512:	87FD4AA5158D09EB97B6131E651DB2A4761546907A960AF7792F8E95947C0A825E84F88ECCF42EC896FF5BB2BBC461488B898D5F1BD853847317493C44B330C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eU!.!4O.!4O.!4O.!4O. 4O.Rich!4O.................PE..L....!.6...........!.........D...............................................p...........................................................@...................`.......................................................................................rsrc....@.......B..................@..@.reloc.......`.......D..............@..B.............!.6............ .......8........!.6............P........!.6............h........!.6.....................!.6....................@:...........J................T.Y.P.E.L.I.B.MSFT................A...........*................................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...............h...........................................L...P.......

C:\ProgramData\mia595B.tmp\data\OFFLINE\mVB.dll\vbrun60.inf

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Generic INItialization configuration [DestinationDirs]
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	5.4959184158351215
Encrypted:	false
SSDEEP:	24:yuZq732XeLfX8IUy3k8exg5S3X8n2uNXVANXVMbNX9NXR/NXVuZZNXV0pT7:BJeL/8IhvFSn82CVoVMB/DViDV057
MD5:	F8854BDCD55ECCF24F077981ADFE6B9A
SHA1:	377FC226B1C10B244F1E32F6EA3A20B5D47D4777
SHA-256:	E5A9050E93487A1D296CEEC10B95BE9F92EB877AA2913296B5C31B9F74F7C788
SHA-512:	6331F337A1595D6F83281614E6A92AABA9D8B27FDA3B5CF4E85F1B49AC335E10F0F62CD147131D53C473B3ACC42BC27F2D02073F0CC60755CA10871EF2E7AC8E
Malicious:	false
Preview:	; INF file for Visual Basic 6.0 Run-time Redist Pack....[DefaultInstall]..CopyFiles=install.files..RegisterOCXs=RegisterFiles....[DestinationDirs]..install.files=11....[install.files]..OLEAUT32.DLL,,OLEAUT32.DLL,32;..OLEPRO32.DLL,,OLEPRO32.DLL,32;..ASYCFILT.DLL,,ASYCFILT.DLL,32;..STDOLE2.TLB,,STDOLE2.TLB,32;..MSVBVM60.DLL,,MSVBVM60.DLL,32;..COMCAT.DLL,,COMCAT.DLL,32;....[RegisterFiles]..%11%\OLEAUT32.DLL..%11%\OLEPRO32.DLL..%11%\MSVBVM60.DLL..%11%\COMCAT.DLL....[OLEAUT32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=2,40,4275,1....[OLEPRO32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=5,0,4275,1....[ASYCFILT.DLL]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[STDOLE2.TLB]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[MSVBVM60.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=6,0,97,82....[COMCAT.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=4,71,1460,1....[version]..signature

C:\ProgramData\mia595B.tmp\data\TDService.msi

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\mia595B.tmp\mia.lib

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5299123
Entropy (8bit):	6.417889890443472
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJk:hTaRZ8tjD4+wD5ZksyPHIFIk
MD5:	5A3DA2206BD35C381B826FF748093684
SHA1:	AE5A7D9CEB4324BCE26B6E2ED7C1FE18DEAF917E
SHA-256:	E94B30CF6F7FA8F30EB21B5A4B3316B5F005321C31A2139095882450D8BF8C78
SHA-512:	DBA818B5E442EA797E4F20F313C2196BA366DE82784968A1F2F29C8F3AAEE5BC09B7B9CC33A959C0E2507F31517E32D48C118CDE5119A741C5378DCF29856801
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.msi

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.res

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3821599
Entropy (8bit):	6.2872927335703555
Encrypted:	false
SSDEEP:	49152:YXlXDzXmLXrXxXzX4XOXWXmOX+rX14rFRMSigFEkEi24EJD2d8hMcSCnmNPIkFVT:cTE94w4BF5
MD5:	839619AB3C498F9119516797217ECE8B
SHA1:	83593C1247452E23F900E2F383B80FCE222E77D5
SHA-256:	C0BA92E82179F99A6CBAE6B26E2CF94DA86D9C2A89FC71552484150D4FB1A237
SHA-512:	8947009EE28BD4A8D6C2BEE4B03474A981A28C789021B31C6B3010FD0727180F16D7FE95F35DE13A533CA56953DE37CC088F496FA82CD4FA0371B9D422C79816
Malicious:	false
Preview:	7z..'...P=".'H:..............oB....TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\mia7B89.tmp\data\OFFLINE\150AC403\DFC33D3E\spectrodens_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\15F69ECD\C2555B5\spectrojet_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\1ABF3862\DFC33D3E\spectrodens_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\ProgramData\mia7B89.tmp\data\OFFLINE\4D56F533\BD12AE78\spectrodens_ir_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\ProgramData\mia7B89.tmp\data\OFFLINE\4F27760E\BD12AE78\spectrodens_ir_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\52B152B3\9B44F18F\spectrodrive_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\ProgramData\mia7B89.tmp\data\OFFLINE\56A7DD7A\5EDECBEE\spectrojet_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\ProgramData\mia7B89.tmp\data\OFFLINE\5809A5D8\5EDECBEE\spectrojet_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\66E41FEB\A1D4A3D9\TK1.cer

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.164821094442024
Encrypted:	false
SSDEEP:	24:3hE3IaffyrWghhywWGwBBrG7V+vXx9uyv1jTRgjDiuVz0mkhfAwfSLC:36DffrgarB8V+vXx9uyv0DiuVxkhfEm
MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
SHA1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
SHA-512:	7232D3260D6714B6DD1B403AB1F838E2D6A33F9AA37D50C2DE4328DBFEA450C3A77875A333968219CB4F8B21140559310FBA42C9833F740A928554387EFFD969
Malicious:	false
Preview:	0.._0..G.......,h..g.0L.....1..0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140304000000Z..170602235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........!.`.x..qr.r.....y.....$<.]./..E.EyJ.&4..}....}Y.O..5up....77.B.E,.U..P..b@.T.Ek..mr_9#.?.n..S....^?j....Z....m8.....L+..n...s.....k.......<\|>_.T9.C...u.S}N...3.C.oKqup>..?`,..U.."..p..3<d<..$Q....\|_...`U.(m...f...j....+-.. F`.....[..e\|..g.?5........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....0*0(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\ProgramData\mia7B89.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\7AA455DC\9C4070E9\dens_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\ProgramData\mia7B89.tmp\data\OFFLINE\849003A2\CFFA0AE5\spectroplate_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\ProgramData\mia7B89.tmp\data\OFFLINE\84FEA59D\CFFA0AE5\spectroplate_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\9E7D6EA9\A1D4A3D9\TK2.cer

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.175302981793894
Encrypted:	false
SSDEEP:	24:/3IaffyrW+hywWGwBBrG7pLqQ9xtRgjDiuVz0mkh6fyzjOlJ9X2I0:/DffrJrB80mgDiuVxkh6fyzSx0
MD5:	1E256F3CD8A847D91596BF2C37DBF285
SHA1:	6641ED279EF1A7A8E6D06BCEB38570B429101AA2
SHA-256:	6FCE0715E8C7D2B5BF2D7B049AE6CB6842E2D9757A2D9296A1587BBD05C2FE25
SHA-512:	91DAD8AFEA4A493269688CA7B7642DA7A663742C5811AADB3EE13D66DCB3BE2B1ED5EA6A9F45FBF9E6E432AEED0A9AE1AAA4A921658F2D5DDF2524C5EF195C3A
Malicious:	false
Preview:	0.._0..G.......7......'@...\...0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...110320000000Z..120307235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........6.....:N~lw..F..J7h...5x._9..\....:.)z..].......g.....4.....D..FI.......s....`L....}..`~.U..E.H....Q........sv.....x.eLh...`..<^.%.. .J.....(5...^.....U.P.....r.......{..u...O..0....V.y......$#...#. N..:...E.L0.CZ..B3.E..@x.?.\|..B.".....&.<.........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....00(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\ProgramData\mia7B89.tmp\data\OFFLINE\B06B5044\C2555B5\spectrojet_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\ProgramData\mia7B89.tmp\data\OFFLINE\B258770\A1D4A3D9\Cert.Bat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.2832136787344055
Encrypted:	false
SSDEEP:	3:HrJQyogRM/fyAiLJQyogRM/cLGr:HeFT9b
MD5:	C10BB4CF9692695632DE53434201ACA9
SHA1:	4215207F1C5E53C2CBA1638C7B27B587F0E48FC6
SHA-256:	CC11C5FEA0D555905CC67BF2081C55F9F82A049EE65A89A371D2310BF37AA8EB
SHA-512:	27234743327A5F7F46B60CD1F544C77353AA93C29E583EE8A8DB801D5E654EEDB2AAF30F8F4EA4219BB53B739C9E51694143009F9533BB456F0B44F2E2ADC862
Malicious:	false
Preview:	certutil -f -addstore TrustedPublisher TK1.cer..certutil -f -addstore TrustedPublisher TK2.cer..

C:\ProgramData\mia7B89.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\CE56FB43\9B44F18F\spectrodrive_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\E09F5A5F\383AE05B\spectrodrive_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\E1318D92\9C4070E9\dens_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\mia7B89.tmp\data\OFFLINE\F2F92670\383AE05B\spectrodrive_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1316352
Entropy (8bit):	6.662123826541052
Encrypted:	false
SSDEEP:	24576:htJHEI7Kl/eZfZblU8u+noMRBqSPSUO9z8mF36X+huHcN2:rkl6PoMRMSSzy+hwcN2
MD5:	595209D10BD0EC1B01F8AC31195E7902
SHA1:	849F59A743DE094C7CF05C7F89B0ED22309B619C
SHA-256:	8D67E430AB5300BBA92B1D1B45D2E87C13E8B0D61A75D02A70BC203696430534
SHA-512:	3AA7C32A3BC9F0A1E5D4B67B657A216131FBDD62E5794403D01FBBCA663420D861460DAEA6ECEA6F2C4268E67B1E2A71DEDE6E6A57FF041E34BFD3F3130EC328
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...X..V.....................j.....................Q....................................................................O........5.......T.............................................................................H.......^....................text...h........................... ..`.itext..T........................... ..`.data....M.......N..................@....bss....TS... ...........................idata...5.......6..................@....didata.^............0..............@....edata..O............:..............@..@.rdata...............<..............@..@.reloc...............>..............@..B.rsrc....T.......T..................@..@....................................@..@........................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1050104
Entropy (8bit):	5.617498652730841
Encrypted:	false
SSDEEP:	12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
MD5:	BE3C79033FA8302002D9D3A6752F2263
SHA1:	A01147731F2E500282ECA5ECE149BCC5423B59D6
SHA-256:	181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
SHA-512:	77097F220CC6D22112B314D3E42B6EEDB9CCD72BEB655B34656326C2C63FB9209977DDAC20E9C53C4EC7CCC8EA6910F400F050F4B0CB98C9F42F89617965AAEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m.......%...........................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\mia7B89.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\ProgramData\mia7B89.tmp\data\TechkonDriver64Bit.msi

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\mia7B89.tmp\mia.lib

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.dat

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.21221799398743
Encrypted:	false
SSDEEP:	6:SpXr+pVSDDDLm+6WWq5vR7xXrlqt+TzTEQjM41wy:SpOSDC+Zb7eKTEsMXy
MD5:	5E1B362822AF7B65CEADD04E17FE93DD
SHA1:	E97136FF549A5EA648B53C852A6CF83D7B214CB8
SHA-256:	3BA47D29D3B8810C479BD6D3D470FC400AA15AA35187BB1FA72C7E20E2573009
SHA-512:	76A2D74395DA1EB6E2292B9CEB743718C9AA8BC03E0F88F7A250E281B5DBD4394429979B89BBD878822984B8C7B821667F2BC30BD833B0CBCA1B61DA23CD0F19
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..TECHKON Device Service..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..11974355..TECHKON DEVICE SERVICE..1150976..$..C:\Program Files (x86)\\TECHKON GmbH\TECHKON Device Service SDK..TRUE....C:\PROGRA~3\{C39D0~1\..MYAH64WOW..x64..OVERRIDECACHE....NATIVE_ENGINE..FALSE..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5295078
Entropy (8bit):	6.41595061147608
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJF:hTaRZ8tjD4+wD5ZksyPHIFIF
MD5:	A94A3D60FA8A54AB71ABED39D5883D86
SHA1:	3FC14B383FD699017AA7B7281C28F143AEAF7B9F
SHA-256:	3AC4616A5ABF9A408EDCCC48D15AB9DD6441DAD273C8F477C1EB291812949451
SHA-512:	172CE336A3343D8ED92EDA525A549F1E388D37076F71DC28C043FABC94B04761B7E936871F203C2B681EB4BFCC8C239327656F51003CD46D11C94589B1E8CC13
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.lnk

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.msi

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.par

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	5.3568493851447085
Encrypted:	false
SSDEEP:	48:n52QnlauJANzvc+/zM2WTZowX6U4WqARxCmlyqGkcz8wV30/33BB+:PZhJwVUBY
MD5:	ECAD24E51736561AFB45CB6F30A38B99
SHA1:	3D8E74E5CB6F940D87985B6386C10B123291278B
SHA-256:	2F167DB1CA0687F1F639588BF8195E5AD52E4B9A11FEFE8E83674585DAE8A389
SHA-512:	6E8E111525F7AF8498F3BAD574E83F78328F0BEC670407668662B707C10F5DD336E11E3FF8826ADF8C2553B2AAE89467EE62A460D616AE0FE8107484A8F1C738
Malicious:	false
Preview:	.AEDD97940..FALSE..A3CE6DECE..FALSE..A34E6DE3C..FALSE..A25D64044..FALSE..A3476C065..FALSE..A8135F827..FALSE..A8808A0B2..FALSE..ACC3273D..FALSE..AA913E6AF..FALSE..ACECD985D..FALSE..AC5D9D236..FALSE..A1A2661C4..FALSE..AC64028C1..FALSE..A3CEB12CD..FALSE..A1872974D..FALSE..AD4D85249..FALSE..AEACB8D8..FALSE..A7C4CDFEC..FALSE..A95FFAA1..FALSE..AF0FC8706..FALSE..AD7FB24C5..FALSE..A86D611ED..FALSE..AEDD97940..TRUE..PEDD97940_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A3CE6DECE..TRUE..P3CE6DECE_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A34E6DE3C..TRUE..P34E6DE3C_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A25D64044..TRUE..P25D64044_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A3476C065..TRUE..P3476C065_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A8135F827..TRUE..P8135F827_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A8808A0B2..TRUE..P8808A0B2_1..C:\Program

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.res

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3831837
Entropy (8bit):	6.288047394335939
Encrypted:	false
SSDEEP:	49152:zXlXDzXmLXrXxXzX4XOXWXmOX+rXAEJD2d8hMcSCnmNPIkFVZ+cocaFjhkSYKPM:xw4BF3ai
MD5:	3EA26D5D84024858345551BDD209F62A
SHA1:	DE89AEAB1CBE1328B0CDB7C17BE2B43BEA076E30
SHA-256:	E58F0C20DFFBB1299D972CC7C3556DDDDE8D6888570FEEF208E48EAD68877149
SHA-512:	5E8F2CCA528F77CC624FD17228D796E3921008A9D73511793E33FE6F4B94463D5304A969A4F18DD0BCDD2C5B0663861570E861DAC58355EF641860BB071AE607
Malicious:	false
Preview:	7z..'.......'p:...............M...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\instance.dat

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.763214906845461
Encrypted:	false
SSDEEP:	3:fCSpmrc5Pk+T0kcAwS+h2h2MxB:rsc5Pk+r0grH
MD5:	36487EC6BBA7512EFC29BEFC31D9C8E0
SHA1:	BBC7D906BFEC90E60D3ED2768FD3DBF1E23A831C
SHA-256:	96DA35BCA6739A48B794F7A93643A4B449F1BDBD0A4506B2CEE752ACF351DF15
SHA-512:	044444B2237DEE8C9CBFB966F9C3EEEBB6FBD0D86643E692E0686A0254919218DB4277A50EF251A26D112286CF64A21685191052B1C31CE03186EF25CB30AC0B
Malicious:	false
Preview:	{CD1E6019-47AE-4334-A91E-595BA68B6E06}..{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}..TECHKON Device Service..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.dat

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.172580566169641
Encrypted:	false
SSDEEP:	6:SpU7SDwVs6ZU9xXiaQoOXtCBnTzTEQjM41wy:SpU7SDXo6UoOd8fTEsMXy
MD5:	78A3F93BD0082F553E5B911C0DF9A218
SHA1:	C435D901BF62921AE6FA320616909CC7EA59A0E4
SHA-256:	B40D65735A6D1D806908ED541F1701C7AD59A9264E0C1081FAAF40635F9024FB
SHA-512:	9C48437D2270962228A0DE928E36E3D4829A932153AC7CF74E2A98895F97FB1E3C884FBF3D49EEE4DDADDEEC3004283E34152527F65B5EA814D3C943D41D395E
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..TechkonDriver64Bit..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..531006..TECHKONDRIVER64BIT..0..$..C:\Program Files\\TECHKON GmbH\TECHKON Driver 64Bit..TRUE....C:\PROGRA~3\{CDCC2~1\..MYAH64WOW..x64..OVERRIDECACHE....NATIVE_ENGINE..FALSE..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5299123
Entropy (8bit):	6.417889890443472
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJk:hTaRZ8tjD4+wD5ZksyPHIFIk
MD5:	5A3DA2206BD35C381B826FF748093684
SHA1:	AE5A7D9CEB4324BCE26B6E2ED7C1FE18DEAF917E
SHA-256:	E94B30CF6F7FA8F30EB21B5A4B3316B5F005321C31A2139095882450D8BF8C78
SHA-512:	DBA818B5E442EA797E4F20F313C2196BA366DE82784968A1F2F29C8F3AAEE5BC09B7B9CC33A959C0E2507F31517E32D48C118CDE5119A741C5378DCF29856801
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.lnk

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.msi

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.par

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	5.37043834977972
Encrypted:	false
SSDEEP:	96:7lpWBZ9pJNvlVPgXPaPsqJziqWq2FmGihH1c8ABhBdFFP5iqcXTUrXzgl:7lpWBZ9pJNvlVUSkyiPzwGihH1c8ABhI
MD5:	739620392BE69EC2AE2BD9439C1245AB
SHA1:	D3BDEB5E747681DDA9C72A1D9498388067FDCF9E
SHA-256:	ED341DC6C04D0485B207949E6E892BE3C4E5ACB18BFC46FD7C690FEBC0E55DFE
SHA-512:	0101E21EDF0DBA5ED4F14E32D743B959D01B254253BD53F422F2CFCC33A3AB9B45ECA337E38F1D330EDC906EEF7C21762251E3F6AC88C6C5CBBD8EE495FE07F5
Malicious:	false
Preview:	.A76FCA102..FALSE..A150AC403..FALSE..A1ABF3862..FALSE..A502E833A..FALSE..ACE56FB43..FALSE..A52B152B3..FALSE..AC0AC9330..FALSE..AE09F5A5F..FALSE..AF2F92670..FALSE..A94312164..FALSE..A5809A5D8..FALSE..A56A7DD7A..FALSE..A1A9DA512..FALSE..A84FEA59D..FALSE..A849003A2..FALSE..A98500B5D..FALSE..A4F27760E..FALSE..A4D56F533..FALSE..A7AA455DC..FALSE..AE1318D92..FALSE..A66980B9F..FALSE..A9167C40A..FALSE..A15F69ECD..FALSE..AB06B5044..FALSE..A66E41FEB..FALSE..A9E7D6EA9..FALSE..AB258770..FALSE..AB5CD4D0..FALSE..A537BC2C1..FALSE..A5D1665DA..FALSE..A6EB99A04..FALSE..AF5C9AD93..FALSE..A21D6E643..FALSE..A63D6488F..FALSE..AF835DFEA..FALSE..A9115C352..FALSE..A76FCA102..TRUE..P76FCA102_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A150AC403..TRUE..P150AC403_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A1ABF3862..TRUE..P1ABF3862_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A502E833A..TRUE..P502E833A_1..C:\Program Files\TECHKON GmbH\TECHKON D

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.res

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3821599
Entropy (8bit):	6.2872927335703555
Encrypted:	false
SSDEEP:	49152:YXlXDzXmLXrXxXzX4XOXWXmOX+rX14rFRMSigFEkEi24EJD2d8hMcSCnmNPIkFVT:cTE94w4BF5
MD5:	839619AB3C498F9119516797217ECE8B
SHA1:	83593C1247452E23F900E2F383B80FCE222E77D5
SHA-256:	C0BA92E82179F99A6CBAE6B26E2CF94DA86D9C2A89FC71552484150D4FB1A237
SHA-512:	8947009EE28BD4A8D6C2BEE4B03474A981A28C789021B31C6B3010FD0727180F16D7FE95F35DE13A533CA56953DE37CC088F496FA82CD4FA0371B9D422C79816
Malicious:	false
Preview:	7z..'...P=".'H:..............oB....TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\instance.dat

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.682207123816963
Encrypted:	false
SSDEEP:	3:P1UckThRSnhZTYIT9ovtndNpnCmiTQeVnh2MjzXFTBQov:9UckTynVT9ovtndfCmi8eVhr3fQov
MD5:	6F37D4EFB813C85449B22D66C053DE6B
SHA1:	DDE70506FB522175DF612A6ADDF04E0009B30FAD
SHA-256:	3687950173500CEF8D7F3EB691FEE0F08866C463E4434282C8DD2A36EDC4A7C2
SHA-512:	5205A6BD0496FFBD307E9D49254D23E71D8C04C04F16A4E57AF708B826306AEFFFA999113D5A1FAFCAEA444C56D33ADAFF994337E6FE0D487C42EDBC289615B9
Malicious:	false
Preview:	{55EA8940-B618-47BD-A642-20BFB2A64F78}..{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}..TECHKON Device Driver 64Bit..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IIIQF\7z.dll

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	6.279217790646268
Encrypted:	false
SSDEEP:	3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
MD5:	31CAD6A3EDD1C32981AD6B565CBEAC94
SHA1:	9338978C85A9423EE2A38CBA027F79192D684F1B
SHA-256:	B8521ABDA09EC17DDAD36528C1BC50395DC8C5F7C11C026A5B3FF23110C54182
SHA-512:	02E198B8EF192DE55DB35AE00A16A80B3309A9373A596C20D617B43DD7159A635BC303F371859E704375521A1242D02754807E2E9DFEF63FFD06993B24C17D3D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..P....................6...>..............._...........6...P...o.^.....o.j....................Rich............................PE..L....S.L...........!........................................................@.......................................@.......9..P...............................@.......................................................,............................text............................... ..`.rdata...@.......B..................@..@.data.......P...4...4..............@....sxdata..............h..............@....rsrc................j..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lang.loc

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	197429
Entropy (8bit):	5.976046888177846
Encrypted:	false
SSDEEP:	3072:VZ2NCsffL4WCb+gS5MJBdpzMObFz7m/RktZtUEEgny32rf:/4L4YCBdpzMAFe/oZtUYny3i
MD5:	B87AFAA4E8FE37C2878E240D7E5B74C4
SHA1:	BD4996CD4CC682E9DC8966BE8D697C91F46FABD7
SHA-256:	077898C146E917107BDB281F4E21C380C5E6B18E9B2213FBDE8FE5FD086336AE
SHA-512:	1EDC62AB821DDDA0EA312CFE4D79F908E3AD6B28C87C903CD956EC9A12E6F62010380A1C0801601185A30D24F9897D81A37A14BD4891E303691DCED2A50F7D1B
Malicious:	false
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

C:\Users\user\AppData\Local\Temp\mia.tmp

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	71603
Entropy (8bit):	5.523940105836007
Encrypted:	false
SSDEEP:	1536:ewNhtmrNAKe1J4eFiLIidSxfuisTJIHvxDZN7kAblAFKqZLYjz1:Vtm572J4egLI4wIZYjZ
MD5:	6614F2128AFB570A9EB3BFBAC47340AB
SHA1:	99356886CF9A2EB83492EED2D1C7F7190353BDDB
SHA-256:	645F8C9588263BB3B0A5BA31A1705EF8931B2247EF6113C2F18F375B67DE94F8
SHA-512:	680B81C9BC89392B4068466AF9CA1C7053DFF548FF34BEEDDDC97A80C324DA696DC955EE6412073FDDE4442031C82DDEE6DAE2A0AAD140877D44941024C446FC
Malicious:	false
Preview:	.Comment..Comment..Code Folding Region..Get System Settings..If..MessageBox..Terminate Install..End..Set 64 Bit Mode..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Set Variable..Set Variable..Comment..If..Set Variable..Set Variable..End..Comment..Code Folding Region..Comment..Code Folding Region..Comment..If..Comment..If..Terminate Install..End..Comment..Comment..If..Set Variable..Set Variable..(Un)Install MSI Setup..If..MessageBox..Terminate Install..End..If..MessageBox..If..Reboot and Resume..Else..Terminate Install..End..End..Set Variable..End..Comment..Hide Dialog..End..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Define Component..Comment..Comment..Get System Settings..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..If..Set Variable..End..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..Code Folding R

C:\Users\user\AppData\Local\Temp\mia1\TDService.msi

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309153147556162
Encrypted:	false
SSDEEP:	12288:RZTHM4uBKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:RFM48x5BqPA2fc7wMz7
MD5:	A9CDCC1CCE934430F30F66BAF6118459
SHA1:	C53F64C4027301E8E94FAA739E3D59E593950854
SHA-256:	4EAEB8F7750D12B3CB411BC20BFF8A3948D977919B65A200B6AA58FC83D268B7
SHA-512:	82C938F3E64C3C88A7508BD9F3519D1FD803101B4EA12474C692585460FEA561D1FD9BD267B63C4F24301854E82DA3462BD4E4969E43277FD7AF48706B882176
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32879
Entropy (8bit):	3.303772475257304
Encrypted:	false
SSDEEP:	768:VDHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfwE:VDXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DA
MD5:	7ABD6BD2B201E76EA624B72EC854E178
SHA1:	B74ECA13809A2439B0A8B769328247EED6ECA6CC
SHA-256:	B7E2337DDFE813C051D10B5CBBBBDC7FCD0EEF4B5B2621C3A77D6B91743C0F4D
SHA-512:	66AF2C8901D8B421C1BC1265CBC8495E19C2346BF8B97D280079E1200578D450B6DEA570B712D350D5BE0A8B88A2615BE4075008D85CCA3CCF5D28A4D9194A9E
Malicious:	false
Preview:	...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32756
Entropy (8bit):	3.2836876237576345
Encrypted:	false
SSDEEP:	768:XyHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfn:X6XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DU
MD5:	BF3263127CD771470559490ADB76647B
SHA1:	8971CB4959D1BCA4A0EC48F3186309B00E16261B
SHA-256:	4811574E264AEB0927806A9A953CEA2A903ED18C36A34A10B67E40B99CA1670F
SHA-512:	9AF82B1F3EB3E735E2434BA803C1FC6D13BC1866A73D9F0FF466A23A5761291DD00A6C0D57BD24CE6CC2DCD0ACC16E863A2F30A41FC4BBBD041578F85AF6AD27
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	161047
Entropy (8bit):	1.9896602276153565
Encrypted:	false
SSDEEP:	192:E3Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CWNux1uAw1Dmi:EtI/gWf
MD5:	5F7AE8AAAC7F8E1E811BE95B187ABB10
SHA1:	C34C69B5AE6B4B2EFAE3236C386F2B0388F815A8
SHA-256:	984A34337FC921BCCBA721B8361D3806459D2F37CBF117F5CC35D6BD0D6FEF6D
SHA-512:	0A6F8E499686102AD85DD411958B3417A4E758FAC61A1D883420490AABDEF0F6CECED358997F83AB84FF7DC2D01A3E90903C899ED382B97165CF019B8C213709
Malicious:	false
Preview:	...TFRMDESIGN.0..u..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	5.018115004625162
Encrypted:	false
SSDEEP:	24:UuikSi+nfi0ZiFuEai/pZSruicvSi+pipUivuNsIi/pEaiDatfi/pTvSgREii/pH:U5ExAGVPbu1ZRMfkf3faWYt
MD5:	2FE4E500443ECB1E27A767BEE9A18C63
SHA1:	887A5789CDAC46BEA2829870DF02AD6B87A92270
SHA-256:	6492FEB41031C64C70FA8FABAABCCDE4846F9438B017D152C68C4B356C6A167A
SHA-512:	9475EB0E7509493A23DEA491CFA0A9A1DB0D339C216F1E38512DF18A74D80C69B6C8CE9C10131047227FFA3E979D5D6F144748569CFD9209C47977D770D94DD4
Malicious:	false
Preview:	IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkSuccess.Caption = COMPLETE) THEN RunNow.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkSuccess.Caption <> COMPLETE) THEN RunNow.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := Fal

C:\Users\user\AppData\Local\Temp\mia1\installaware.png

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	7.871063017224323
Encrypted:	false
SSDEEP:	24:X93kpZjQLmEcxtIwWXPAGpKpkZcks41xdrqUaBdJbYfxpJgx7YWg/uLwdCnq:N3Yj8mEcxywiPrpKpNMdr07SxgSt
MD5:	B7225A16DAF9DE1D514AEFE567FDF2F5
SHA1:	D6A00C526C425FCD5EF49B0C87814F2CF476CB59
SHA-256:	0E2DEFC9B470D3F9BD184D254493EFAD94EA0273C1FE17FC8FC651D47B01734E
SHA-512:	31412603AE87F2B9C9DAD2D0BA64868105586D1778846DE5F1C14667C4292DE36FC193B54670BDF130019B0B42AB59EEF2C2D8672226BA755181FEA894BD9246
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.W.L.W...!..dl.'.@.10.a.....2.T'.....SD..-PK@t.....:53.... :#F.......\|"...L....6 m)Lw........9...K.+.b...z.x........=...J.V....n3[.B..v[m..../....o0.L....Q...&...$~?%%?PG..S<..]...$.Z......O.3".k....m]..2S9..4,.k+.xf..k.F...V..4[Ec'K.2.2..PK.....H$..H.....kA...M..>.zs.....^...K"...j..:..Hu.T..Q.....N...y'.+9.dR.{..Xn....w.f...R.KQB.]z........6>..,.......q.%........;.,......U{.i....Z.....)._I..7..J.q..d)...CM....;...,R~.B.S...E...p[-O........].F...%..A.%....{.%....]Q..>.-..f..C..i.Q..+5.......A'~.....J...M.mtN..0..r.>.@K.....D...<...CI^#.-.P.}?R..M.-.7..GS...Z^9s..<6.....>......<..g.~.9....{]Ju..}`..Z(..ikw^.,)X..g...\|G.LQ9A^...9pe....7d.......SE.Q..../nx.}_..F...$..I..K...o4.^ ..e.X.Q.H......&........Q..............\n....J......./...7.....E.9.....$...K..!...c.`.=.Jd.nq.n.W.Q...Q.#s.w._.d....u...Q].-U.N.J..&.O..=......a+.k.....%.$..(.....@`...lx.......tDC..=.{...^"...@.....\{;#.^...G.q./AA.

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32086
Entropy (8bit):	3.1568876532608567
Encrypted:	false
SSDEEP:	768:PGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfp:P+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DC
MD5:	D5DF18B96E3A0E9DA52766BDEB603E4B
SHA1:	A1D313F08A9B663F8DB7BCB258EFA616BB2618DB
SHA-256:	C1E2B73702BE7EA8E2BB9CEC1F9D210757D67EB950D8A22EA39E0E2C5F9AF6B0
SHA-512:	AB60CE2806739B62EC063FABA81A17CFEEA3CFCD546E9DD8F486DA3491DF3BB76C7020E35B5C2898A923736672E3AE9CA2400978DCBFBD8B75E76B579B85FED1
Malicious:	false
Preview:	...TFRMDESIGN.0.B}..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1326592
Entropy (8bit):	6.662178971692568
Encrypted:	false
SSDEEP:	24576:9JGBDZIKwoTaK/T/Tua+hWWfnElT/XhBiSwmK9lHcPJMgh:vqxaSzqUNBXhkSwQPi
MD5:	AC12DEC48405495C2008858D243DA8BC
SHA1:	0B6AD42CDE232A81B415481B772319FB1138C35E
SHA-256:	AD45020E327C16F0A847C38A058E606A7738EA6D0DDAAF80439797CA95F5FD43
SHA-512:	F6A381063DC321C85BD9FFECD524FCFA4EB968AA7644AB339F292B7037BE9C1FA997D2CAD382BE92848010AEEEA38209908B5FAE17CD0B261E0DBEFA38BF5F58
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.....................t.....................Q....................................................................N.......\7.......Z..........................................................................,................................text...\........................... ..`.itext.............................. ..`.data....M.......N..................@....bss.....T...@...........................idata..\7.......8..................@....didata..............P..............@....edata..N............Z..............@..@.rdata...............\..............@..@.reloc...............^..............@..B.rsrc....Z.......Z..................@..@.....................>..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160192
Entropy (8bit):	1.9416958546631025
Encrypted:	false
SSDEEP:	192:TdRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cdtq69wTEmC+:TvI/Lw76
MD5:	68E84CD5CA646B0204CD019CC6B63DCD
SHA1:	B00E7D577E350F96149E5C14C6DDA8B05994462D
SHA-256:	ECCE7B76CEE8E1C10D828DC932F1BFDC782F1B599C1BF13651C21B73A5AE1A4A
SHA-512:	E848350BD35C9DD7B7AFA741BD4089763EA990B7F27AF96C3067E308A9AF812D83DB5F48E2EF8A6CE3E221036B1C76F0802A87DF9FC16CEB8C3B8E03619A1C85
Malicious:	false
Preview:	...TFRMDESIGN.0..q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32211
Entropy (8bit):	3.1826203678135156
Encrypted:	false
SSDEEP:	768:iVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfb:idXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
MD5:	1074D7C4D94AF399F1F6137AD183E70D
SHA1:	9C7BDC1EFDEC073746AD9B7478F113D9EBD403EB
SHA-256:	2AA0603ADAA5058A1C118C8F2FAACD333D31112EC4C75689F765E4BC3AF69473
SHA-512:	38C7A641A232F2A67F10904716D13C137F08A0A19F47D209994FF63BFB198D8BB89075CD78BD23FF26427CFB3BDC53585EC33735A6FFF5E76834278D958AD1ED
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left.D..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.959095954912026
Encrypted:	false
SSDEEP:	6:aG1uSLF2du6szW4Rl1Ac2duJRl1Ow0Ld2du4LRl1uSLju6szWAK1Ow0Lru4FK1AC:qITMDIb6UIJTc6S6jO
MD5:	D8BA1E1B3F547F94CB059C8ACEC89297
SHA1:	71A5043CA3BF89FECA070431985C232E28940AAB
SHA-256:	62EE20B127F44C2D91BBCC9A232689DD3F1BC3359E606257BF3B115D4CBBDD2C
SHA-512:	5DA1E4DEB8518CD7AF202E7169F181683C74A83F62D98A36DEB45A03E14F384410633017D16CCBB6E216904F40AC782D7BE97940EACAB7D60B2D54CB7DBAEDC9
Malicious:	false
Preview:	IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	43052
Entropy (8bit):	4.120190601260142
Encrypted:	false
SSDEEP:	768:yJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf9:yhXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dy
MD5:	57A89F49FD0EE39606E927B96B00CFE5
SHA1:	5D94926CAF2BE0284B0B4CB7E69ECFA7A9A63284
SHA-256:	8B4D56464B9F2050B89134F7BCC8CD0FAFE946CE062F320915B0404685BDA111
SHA-512:	186F50C78EBD96CB12E8F7D5DF249AFBBA3C71E5DF96AB4F293DB2AC99593459F634C0BFA3B1C2FF34063819894FB9F446000110069B1DE2DD63B47874956E7E
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.740550563860751
Encrypted:	false
SSDEEP:	6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukAh:csIrqar1sIroarg
MD5:	86B3EBFBD934B66842048F0AA241E5C5
SHA1:	F770786C29D12D8C33B975EF2BAAD6D59A90F7CF
SHA-256:	4AEDBF26E568E62B47517E91FBCC818A5B95BD7FDB8A7DC5B826C0BD194077A6
SHA-512:	FE37AD98EC8DE62CE6E6A46E284450BBE19B7D8EB8C7B3B81BD06BA22EEBA487C2CEE8C3B37CD84FEAA09F8F39BDF532371B57FCCC7788A2F54EDA3390E58FD3
Malicious:	false
Preview:	IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	42687
Entropy (8bit):	4.076635616143556
Encrypted:	false
SSDEEP:	768:PoHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf/i:PoXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DJ
MD5:	0379D6212582C3FFF4E2E205B9585151
SHA1:	72BCF5C26E8270EC72F53EDC69D970E65CEE7229
SHA-256:	9495AE09659EA231157D576BF325CF8A55C191A493CF9EA39979CBC3497B281B
SHA-512:	D65059609CF44FDEA5134CC542835B7CD1FCB0873854D6BDB6A15D53737CD090F65CA119D81A0D3DCA5E0289E666395E140564B457870BDFD5A6334EBE41BE0C
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	3.1261873313705286
Encrypted:	false
SSDEEP:	768:KGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfjE:K+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Db
MD5:	92B2E967740B9A9566132617654F99CE
SHA1:	9E5CD494173A9BABFC520E085B66CAD832FA9263
SHA-256:	4CB5450E2366EB03855CB1890C84245BD21975B353807F820C461F56577E02D1
SHA-512:	233442A840DBCC4B37FF40CE8B97E2B4A157043A8B552236B2A24BA0DB18AA38CCA99B2F257272DA577793B129C047895D46A68214074D977E6930571974A3C4
Malicious:	false
Preview:	...TFRMDESIGN.0..\|..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32180
Entropy (8bit):	3.176260859175472
Encrypted:	false
SSDEEP:	768:5UVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfA:5UdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5F
MD5:	56BAD53F5F88A0340D5835A37CCC33C5
SHA1:	943A88F953CD36E9F79B6681BDB3949071F60188
SHA-256:	7BEB6D4F0AC884F33B9528E3C56BEE15E3D4BD33D16DE40F242B024CE68FC4B0
SHA-512:	79AD20CD678C8C3F9A6571BEBDAC570B7167813310C44BEC1D67EC881F9FFC843965FF0B047F31E154A616B2E917A291DD8765B217674A963A7FCD57C20737C5
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!.

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.56478131967351
Encrypted:	false
SSDEEP:	6:aFiLYMtrk8FYMLYMtrk8W7qMtrkeqYRqMtrkt:+GYMtg+YMtgdmMtgpMtgt
MD5:	2FA9DDBED5C616D3838AD3934F3B2D7D
SHA1:	234B295897F4F8E6E991A5B362B5F5D8011EC24B
SHA-256:	4FB0948F1707CE29811F05CB06169D1360B08445AAA180EAB814EBADDF2BB101
SHA-512:	DAFE8B7BBF7BBFC6816707F131AB66924964576BD4BE5FD2986611212E7D7D436C71112CFCDD8EBF42F6C515700165D8305357DFA7030391E4B99E4998E91A70
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32912
Entropy (8bit):	3.310684742077839
Encrypted:	false
SSDEEP:	768:+tHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMb:+VXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DP
MD5:	C44488F6F633D32EA08F480FC760607C
SHA1:	6979D51D6398EFFF9742D09E022534A05AB9271A
SHA-256:	95C6B4CF234F726DDE2F63F9B162817A6807B3F33CC513C6FAF5E8BA0FB2A79A
SHA-512:	1C8EA5B2C0898DB712D9027E1B2B8AB8B569B520CEFE755B62C648EA9EBB8C720357DD4DB9E6F03D4C8143C524942D22AE9FD83F89EF5553E5E88AFEA0235E53
Malicious:	false
Preview:	...TFRMDESIGN.0.\|...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.629672896174913
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mth:+ff7kkKSHFmBBApVeNF
MD5:	5D78380EBDAD86764F26B73474DF4900
SHA1:	D2574CD9FB599E81C6099738D9D7974CE4039AFD
SHA-256:	DAA5742D80E19668753D435DA0937A4409D22AF73FBAF9DF22EC4CBC34FF5D45
SHA-512:	3533A9D8F4B1D8BD703856B150B8CBA99CA8CF55EF2182EB7B7326BF742C2B4B5CEA896B818FB690E0678689A8B452F22F5F548124D0B8302D776E8B2335B26D
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33198
Entropy (8bit):	3.359763390973846
Encrypted:	false
SSDEEP:	768:DIHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf7q:DIXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	EFB592762376173C651EC1755E26DD1F
SHA1:	3ECBFC3F6058E6F827A2FD91A7AB94EB7E60A045
SHA-256:	ED39514751D8C9913F0A3C222F29FFC85F0EE3D107A222BD668DB96125190A03
SHA-512:	062BBBBBEC95FA272D2F35EACAF2DE3D8BD3D04E027FB34059CD25D0E482D525393D81AA7DD575BDB5970DA298A87C916283983E2B66208B6787747D72E2D8A5
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159671
Entropy (8bit):	1.9106205211543585
Encrypted:	false
SSDEEP:	192:mrRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4C/DEtdmpJ:m5I/SKi
MD5:	5773034B4AA211DB5CCCA92B4A346660
SHA1:	99948D4B79CFB184B076CC156F7656E4C3604438
SHA-256:	AF00C29E992E19D6DBE9D8DC5535BED62475F09B6E79EAE64B92E6B7CC801170
SHA-512:	E6B23477655045A65442E383748C6883AC0560CC3152DC8A5D19D8DAAE0BD5345B28392C804F3E1B0A3572410CB1AFCEB1EA2C195A976DD432CB0705B2398953
Malicious:	false
Preview:	...TFRMDESIGN.0..o..TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................................

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32908
Entropy (8bit):	3.3110543872756732
Encrypted:	false
SSDEEP:	768:qNHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfX1:q1XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5De
MD5:	5A8C8E081C329D3F53494AECEF81BD82
SHA1:	9F1037A2CF254FA932D2A642C4ABD84E0770E167
SHA-256:	FE73CBFCCECE99991601E653E816A1489425BC8701EEC2CF89724239316CC8CC
SHA-512:	9565DD95764D8B6E1761E323BD12420E84733CB6D35DDAADE755186E208C81308231C891CF00296E4F2FE7493D7E9DEE04A68DA7624D8F69C49A2DAC4B865B01
Malicious:	false
Preview:	...TFRMDESIGN.0.x...TPF0.TfrmDesign.frmDesign.Left.u..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.823487220355037
Encrypted:	false
SSDEEP:	6:aoqLYMtrk8LTqMtrkegurusdrHE8Pud2dusdrHEt:jOYMtgQeMtg1dsdrHEUxIsdrHEt
MD5:	8ED569EB90D7EC0791C65F696B85AA4B
SHA1:	AA48F7BD2BA3A2F5DD63D25DA56A1039A18E7FB0
SHA-256:	ABF9F1E255935EC3BA966B8CDA6D129F93F28F43F8C805523B4846769C90F788
SHA-512:	3BDBBDF37199E6FEB281867FFDE480782905E0C24DB729DBF78D6FA0D92A363AA0CABBE20303E06D1327A24C3142F0EF72F8B0AF1ED268652DB301407A4F5926
Malicious:	false
Preview:	IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159591
Entropy (8bit):	1.9059323470293204
Encrypted:	false
SSDEEP:	192:26Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBH1qw3cmrw:2QI/VnP
MD5:	C61886A33BF58C3BC38FA869019DA28E
SHA1:	C2E1B87CCBD13CBE8AFB4FC278A5BA0635C97279
SHA-256:	39056A7647F8135EDF8D8D80F81C53153CCE7E5BCC858ECC81BE6F0075692A26
SHA-512:	65EDBD0675A8282ECD0CCD74BDA2F458D222EAFA5BF29BE61F5F081D3FB53B38797B57BBF78C544771F362ED6F03929FEAB19C2E6928222AAD8BC1A53DF81263
Malicious:	false
Preview:	...TFRMDESIGN.0.So..TPF0.TfrmDesign.frmDesign.Left.+..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31822
Entropy (8bit):	3.1036618557972493
Encrypted:	false
SSDEEP:	768:sHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfU:snXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	01216764772CEB5308A494AFD9D73C37
SHA1:	88A301C9F21316D7AA3B909C3EF18A3F3EC164F7
SHA-256:	EC6130DCA3F4C1AF10559659024F6A5DC97D8B31E415715CF5C9D662BAC5743F
SHA-512:	6E3399DCD1A3EC38045FF360E53FBC836CDCBC763AABFFC9253F07F9A9683E2D605F088E885BE0254096430601F484740240D739110E557C458BE0851868E7BA
Malicious:	false
Preview:	...TFRMDESIGN.0.:\|..TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\TechkonDriver64Bit.msi

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315742525627603
Encrypted:	false
SSDEEP:	12288:0to4wBKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:0to4ql5BqPA2fc7wMz7
MD5:	345DD7F8B98628179CF1E01A15B4C502
SHA1:	DF616AC0649525B0C0023C73B6C2DA6BCEFC9A23
SHA-256:	52B3F0E622DCC2DF803503DE301F7BA917F602F9F26F033184B2AB6151006E7A
SHA-512:	484FFD76D39E1C2D785238A381266D594DD0EA0A1BC9EA28F04672B8398790BF87680F7B947FDBEF4F3BD01E2356E905FB6E5E1953531DAD76F04649A1488721
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Users\user\AppData\Local\Temp\mia2\componentstree.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32879
Entropy (8bit):	3.303772475257304
Encrypted:	false
SSDEEP:	768:VDHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfwE:VDXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DA
MD5:	7ABD6BD2B201E76EA624B72EC854E178
SHA1:	B74ECA13809A2439B0A8B769328247EED6ECA6CC
SHA-256:	B7E2337DDFE813C051D10B5CBBBBDC7FCD0EEF4B5B2621C3A77D6B91743C0F4D
SHA-512:	66AF2C8901D8B421C1BC1265CBC8495E19C2346BF8B97D280079E1200578D450B6DEA570B712D350D5BE0A8B88A2615BE4075008D85CCA3CCF5D28A4D9194A9E
Malicious:	false
Preview:	...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\destination.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32756
Entropy (8bit):	3.2836876237576345
Encrypted:	false
SSDEEP:	768:XyHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfn:X6XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DU
MD5:	BF3263127CD771470559490ADB76647B
SHA1:	8971CB4959D1BCA4A0EC48F3186309B00E16261B
SHA-256:	4811574E264AEB0927806A9A953CEA2A903ED18C36A34A10B67E40B99CA1670F
SHA-512:	9AF82B1F3EB3E735E2434BA803C1FC6D13BC1866A73D9F0FF466A23A5761291DD00A6C0D57BD24CE6CC2DCD0ACC16E863A2F30A41FC4BBBD041578F85AF6AD27
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\finish.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	161047
Entropy (8bit):	1.9896602276153565
Encrypted:	false
SSDEEP:	192:E3Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CWNux1uAw1Dmi:EtI/gWf
MD5:	5F7AE8AAAC7F8E1E811BE95B187ABB10
SHA1:	C34C69B5AE6B4B2EFAE3236C386F2B0388F815A8
SHA-256:	984A34337FC921BCCBA721B8361D3806459D2F37CBF117F5CC35D6BD0D6FEF6D
SHA-512:	0A6F8E499686102AD85DD411958B3417A4E758FAC61A1D883420490AABDEF0F6CECED358997F83AB84FF7DC2D01A3E90903C899ED382B97165CF019B8C213709
Malicious:	false
Preview:	...TFRMDESIGN.0..u..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\finish.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	5.018115004625162
Encrypted:	false
SSDEEP:	24:UuikSi+nfi0ZiFuEai/pZSruicvSi+pipUivuNsIi/pEaiDatfi/pTvSgREii/pH:U5ExAGVPbu1ZRMfkf3faWYt
MD5:	2FE4E500443ECB1E27A767BEE9A18C63
SHA1:	887A5789CDAC46BEA2829870DF02AD6B87A92270
SHA-256:	6492FEB41031C64C70FA8FABAABCCDE4846F9438B017D152C68C4B356C6A167A
SHA-512:	9475EB0E7509493A23DEA491CFA0A9A1DB0D339C216F1E38512DF18A74D80C69B6C8CE9C10131047227FFA3E979D5D6F144748569CFD9209C47977D770D94DD4
Malicious:	false
Preview:	IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkSuccess.Caption = COMPLETE) THEN RunNow.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkSuccess.Caption <> COMPLETE) THEN RunNow.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := Fal

C:\Users\user\AppData\Local\Temp\mia2\licensecheck.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32086
Entropy (8bit):	3.1568876532608567
Encrypted:	false
SSDEEP:	768:PGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfp:P+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DC
MD5:	D5DF18B96E3A0E9DA52766BDEB603E4B
SHA1:	A1D313F08A9B663F8DB7BCB258EFA616BB2618DB
SHA-256:	C1E2B73702BE7EA8E2BB9CEC1F9D210757D67EB950D8A22EA39E0E2C5F9AF6B0
SHA-512:	AB60CE2806739B62EC063FABA81A17CFEEA3CFCD546E9DD8F486DA3491DF3BB76C7020E35B5C2898A923736672E3AE9CA2400978DCBFBD8B75E76B579B85FED1
Malicious:	false
Preview:	...TFRMDESIGN.0.B}..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1316352
Entropy (8bit):	6.662123826541052
Encrypted:	false
SSDEEP:	24576:htJHEI7Kl/eZfZblU8u+noMRBqSPSUO9z8mF36X+huHcN2:rkl6PoMRMSSzy+hwcN2
MD5:	595209D10BD0EC1B01F8AC31195E7902
SHA1:	849F59A743DE094C7CF05C7F89B0ED22309B619C
SHA-256:	8D67E430AB5300BBA92B1D1B45D2E87C13E8B0D61A75D02A70BC203696430534
SHA-512:	3AA7C32A3BC9F0A1E5D4B67B657A216131FBDD62E5794403D01FBBCA663420D861460DAEA6ECEA6F2C4268E67B1E2A71DEDE6E6A57FF041E34BFD3F3130EC328
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...X..V.....................j.....................Q....................................................................O........5.......T.............................................................................H.......^....................text...h........................... ..`.itext..T........................... ..`.data....M.......N..................@....bss....TS... ...........................idata...5.......6..................@....didata.^............0..............@....edata..O............:..............@..@.rdata...............<..............@..@.reloc...............>..............@..B.rsrc....T.......T..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia2\maintenance.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160192
Entropy (8bit):	1.9416958546631025
Encrypted:	false
SSDEEP:	192:TdRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cdtq69wTEmC+:TvI/Lw76
MD5:	68E84CD5CA646B0204CD019CC6B63DCD
SHA1:	B00E7D577E350F96149E5C14C6DDA8B05994462D
SHA-256:	ECCE7B76CEE8E1C10D828DC932F1BFDC782F1B599C1BF13651C21B73A5AE1A4A
SHA-512:	E848350BD35C9DD7B7AFA741BD4089763EA990B7F27AF96C3067E308A9AF812D83DB5F48E2EF8A6CE3E221036B1C76F0802A87DF9FC16CEB8C3B8E03619A1C85
Malicious:	false
Preview:	...TFRMDESIGN.0..q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\prereq.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32211
Entropy (8bit):	3.1826203678135156
Encrypted:	false
SSDEEP:	768:iVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfb:idXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
MD5:	1074D7C4D94AF399F1F6137AD183E70D
SHA1:	9C7BDC1EFDEC073746AD9B7478F113D9EBD403EB
SHA-256:	2AA0603ADAA5058A1C118C8F2FAACD333D31112EC4C75689F765E4BC3AF69473
SHA-512:	38C7A641A232F2A67F10904716D13C137F08A0A19F47D209994FF63BFB198D8BB89075CD78BD23FF26427CFB3BDC53585EC33735A6FFF5E76834278D958AD1ED
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left.D..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.959095954912026
Encrypted:	false
SSDEEP:	6:aG1uSLF2du6szW4Rl1Ac2duJRl1Ow0Ld2du4LRl1uSLju6szWAK1Ow0Lru4FK1AC:qITMDIb6UIJTc6S6jO
MD5:	D8BA1E1B3F547F94CB059C8ACEC89297
SHA1:	71A5043CA3BF89FECA070431985C232E28940AAB
SHA-256:	62EE20B127F44C2D91BBCC9A232689DD3F1BC3359E606257BF3B115D4CBBDD2C
SHA-512:	5DA1E4DEB8518CD7AF202E7169F181683C74A83F62D98A36DEB45A03E14F384410633017D16CCBB6E216904F40AC782D7BE97940EACAB7D60B2D54CB7DBAEDC9
Malicious:	false
Preview:	IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia2\progress.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	43052
Entropy (8bit):	4.120190601260142
Encrypted:	false
SSDEEP:	768:yJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf9:yhXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dy
MD5:	57A89F49FD0EE39606E927B96B00CFE5
SHA1:	5D94926CAF2BE0284B0B4CB7E69ECFA7A9A63284
SHA-256:	8B4D56464B9F2050B89134F7BCC8CD0FAFE946CE062F320915B0404685BDA111
SHA-512:	186F50C78EBD96CB12E8F7D5DF249AFBBA3C71E5DF96AB4F293DB2AC99593459F634C0BFA3B1C2FF34063819894FB9F446000110069B1DE2DD63B47874956E7E
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\progress.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.740550563860751
Encrypted:	false
SSDEEP:	6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukAh:csIrqar1sIroarg
MD5:	86B3EBFBD934B66842048F0AA241E5C5
SHA1:	F770786C29D12D8C33B975EF2BAAD6D59A90F7CF
SHA-256:	4AEDBF26E568E62B47517E91FBCC818A5B95BD7FDB8A7DC5B826C0BD194077A6
SHA-512:	FE37AD98EC8DE62CE6E6A46E284450BBE19B7D8EB8C7B3B81BD06BA22EEBA487C2CEE8C3B37CD84FEAA09F8F39BDF532371B57FCCC7788A2F54EDA3390E58FD3
Malicious:	false
Preview:	IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia2\progressprereq.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	42687
Entropy (8bit):	4.076635616143556
Encrypted:	false
SSDEEP:	768:PoHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf/i:PoXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DJ
MD5:	0379D6212582C3FFF4E2E205B9585151
SHA1:	72BCF5C26E8270EC72F53EDC69D970E65CEE7229
SHA-256:	9495AE09659EA231157D576BF325CF8A55C191A493CF9EA39979CBC3497B281B
SHA-512:	D65059609CF44FDEA5134CC542835B7CD1FCB0873854D6BDB6A15D53737CD090F65CA119D81A0D3DCA5E0289E666395E140564B457870BDFD5A6334EBE41BE0C
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\readme.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	3.1261873313705286
Encrypted:	false
SSDEEP:	768:KGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfjE:K+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Db
MD5:	92B2E967740B9A9566132617654F99CE
SHA1:	9E5CD494173A9BABFC520E085B66CAD832FA9263
SHA-256:	4CB5450E2366EB03855CB1890C84245BD21975B353807F820C461F56577E02D1
SHA-512:	233442A840DBCC4B37FF40CE8B97E2B4A157043A8B552236B2A24BA0DB18AA38CCA99B2F257272DA577793B129C047895D46A68214074D977E6930571974A3C4
Malicious:	false
Preview:	...TFRMDESIGN.0..\|..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\readme.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\registration.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32180
Entropy (8bit):	3.176260859175472
Encrypted:	false
SSDEEP:	768:5UVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfA:5UdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5F
MD5:	56BAD53F5F88A0340D5835A37CCC33C5
SHA1:	943A88F953CD36E9F79B6681BDB3949071F60188
SHA-256:	7BEB6D4F0AC884F33B9528E3C56BEE15E3D4BD33D16DE40F242B024CE68FC4B0
SHA-512:	79AD20CD678C8C3F9A6571BEBDAC570B7167813310C44BEC1D67EC881F9FFC843965FF0B047F31E154A616B2E917A291DD8765B217674A963A7FCD57C20737C5
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!.

C:\Users\user\AppData\Local\Temp\mia2\registration.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.56478131967351
Encrypted:	false
SSDEEP:	6:aFiLYMtrk8FYMLYMtrk8W7qMtrkeqYRqMtrkt:+GYMtg+YMtgdmMtgpMtgt
MD5:	2FA9DDBED5C616D3838AD3934F3B2D7D
SHA1:	234B295897F4F8E6E991A5B362B5F5D8011EC24B
SHA-256:	4FB0948F1707CE29811F05CB06169D1360B08445AAA180EAB814EBADDF2BB101
SHA-512:	DAFE8B7BBF7BBFC6816707F131AB66924964576BD4BE5FD2986611212E7D7D436C71112CFCDD8EBF42F6C515700165D8305357DFA7030391E4B99E4998E91A70
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32912
Entropy (8bit):	3.310684742077839
Encrypted:	false
SSDEEP:	768:+tHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMb:+VXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DP
MD5:	C44488F6F633D32EA08F480FC760607C
SHA1:	6979D51D6398EFFF9742D09E022534A05AB9271A
SHA-256:	95C6B4CF234F726DDE2F63F9B162817A6807B3F33CC513C6FAF5E8BA0FB2A79A
SHA-512:	1C8EA5B2C0898DB712D9027E1B2B8AB8B569B520CEFE755B62C648EA9EBB8C720357DD4DB9E6F03D4C8143C524942D22AE9FD83F89EF5553E5E88AFEA0235E53
Malicious:	false
Preview:	...TFRMDESIGN.0.\|...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.629672896174913
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mth:+ff7kkKSHFmBBApVeNF
MD5:	5D78380EBDAD86764F26B73474DF4900
SHA1:	D2574CD9FB599E81C6099738D9D7974CE4039AFD
SHA-256:	DAA5742D80E19668753D435DA0937A4409D22AF73FBAF9DF22EC4CBC34FF5D45
SHA-512:	3533A9D8F4B1D8BD703856B150B8CBA99CA8CF55EF2182EB7B7326BF742C2B4B5CEA896B818FB690E0678689A8B452F22F5F548124D0B8302D776E8B2335B26D
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\setuptype.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33198
Entropy (8bit):	3.359763390973846
Encrypted:	false
SSDEEP:	768:DIHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf7q:DIXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	EFB592762376173C651EC1755E26DD1F
SHA1:	3ECBFC3F6058E6F827A2FD91A7AB94EB7E60A045
SHA-256:	ED39514751D8C9913F0A3C222F29FFC85F0EE3D107A222BD668DB96125190A03
SHA-512:	062BBBBBEC95FA272D2F35EACAF2DE3D8BD3D04E027FB34059CD25D0E482D525393D81AA7DD575BDB5970DA298A87C916283983E2B66208B6787747D72E2D8A5
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..

C:\Users\user\AppData\Local\Temp\mia2\startinstallation.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159671
Entropy (8bit):	1.9106205211543585
Encrypted:	false
SSDEEP:	192:mrRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4C/DEtdmpJ:m5I/SKi
MD5:	5773034B4AA211DB5CCCA92B4A346660
SHA1:	99948D4B79CFB184B076CC156F7656E4C3604438
SHA-256:	AF00C29E992E19D6DBE9D8DC5535BED62475F09B6E79EAE64B92E6B7CC801170
SHA-512:	E6B23477655045A65442E383748C6883AC0560CC3152DC8A5D19D8DAAE0BD5345B28392C804F3E1B0A3572410CB1AFCEB1EA2C195A976DD432CB0705B2398953
Malicious:	false
Preview:	...TFRMDESIGN.0..o..TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................................

C:\Users\user\AppData\Local\Temp\mia2\startmenu.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32908
Entropy (8bit):	3.3110543872756732
Encrypted:	false
SSDEEP:	768:qNHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfX1:q1XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5De
MD5:	5A8C8E081C329D3F53494AECEF81BD82
SHA1:	9F1037A2CF254FA932D2A642C4ABD84E0770E167
SHA-256:	FE73CBFCCECE99991601E653E816A1489425BC8701EEC2CF89724239316CC8CC
SHA-512:	9565DD95764D8B6E1761E323BD12420E84733CB6D35DDAADE755186E208C81308231C891CF00296E4F2FE7493D7E9DEE04A68DA7624D8F69C49A2DAC4B865B01
Malicious:	false
Preview:	...TFRMDESIGN.0.x...TPF0.TfrmDesign.frmDesign.Left.u..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.823487220355037
Encrypted:	false
SSDEEP:	6:aoqLYMtrk8LTqMtrkegurusdrHE8Pud2dusdrHEt:jOYMtgQeMtg1dsdrHEUxIsdrHEt
MD5:	8ED569EB90D7EC0791C65F696B85AA4B
SHA1:	AA48F7BD2BA3A2F5DD63D25DA56A1039A18E7FB0
SHA-256:	ABF9F1E255935EC3BA966B8CDA6D129F93F28F43F8C805523B4846769C90F788
SHA-512:	3BDBBDF37199E6FEB281867FFDE480782905E0C24DB729DBF78D6FA0D92A363AA0CABBE20303E06D1327A24C3142F0EF72F8B0AF1ED268652DB301407A4F5926
Malicious:	false
Preview:	IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\welcome.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159591
Entropy (8bit):	1.9059323470293204
Encrypted:	false
SSDEEP:	192:26Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBH1qw3cmrw:2QI/VnP
MD5:	C61886A33BF58C3BC38FA869019DA28E
SHA1:	C2E1B87CCBD13CBE8AFB4FC278A5BA0635C97279
SHA-256:	39056A7647F8135EDF8D8D80F81C53153CCE7E5BCC858ECC81BE6F0075692A26
SHA-512:	65EDBD0675A8282ECD0CCD74BDA2F458D222EAFA5BF29BE61F5F081D3FB53B38797B57BBF78C544771F362ED6F03929FEAB19C2E6928222AAD8BC1A53DF81263
Malicious:	false
Preview:	...TFRMDESIGN.0.So..TPF0.TfrmDesign.frmDesign.Left.+..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\wizard.dfm

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31822
Entropy (8bit):	3.1036618557972493
Encrypted:	false
SSDEEP:	768:sHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfU:snXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	01216764772CEB5308A494AFD9D73C37
SHA1:	88A301C9F21316D7AA3B909C3EF18A3F3EC164F7
SHA-256:	EC6130DCA3F4C1AF10559659024F6A5DC97D8B31E415715CF5C9D662BAC5743F
SHA-512:	6E3399DCD1A3EC38045FF360E53FBC836CDCBC763AABFFC9253F07F9A9683E2D605F088E885BE0254096430601F484740240D739110E557C458BE0851868E7BA
Malicious:	false
Preview:	...TFRMDESIGN.0.:\|..TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET16FE.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET171E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\SET173E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{55EA8940-B618-47BD-A642-20BFB2A64F78}

Download File

Process:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8061
Entropy (8bit):	5.468784701284559
Encrypted:	false
SSDEEP:	192:rZyVhFTzHjHP2CSIizfTQAkVxdUM47BjzFPaXp5MFrgLmtJ6XWFXQhjXT9lXAEju:dyVhFTzHjHP2CSIiz7QAkVxdUM47Bj5F
MD5:	506D3FB89B1AB5EFF5FC21DBE560D246
SHA1:	B7544CA6E08EDFEBC7A16D1BF63D2D304A772713
SHA-256:	33D5610347FBB0D923B18927E28E452D097C21B1B7CBD226E3BBECD3F98AEA8C
SHA-512:	CC7C15D759DE5DEF04C421C4C18E2DFB8E4F6E68E2DD51C059BA9DC9D34E398660C6C558EB18DF3B3F55B32050C87AA328FFEBD4576C83B31417D19FCA1E640F
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\{CDCC2~1\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\..$ex..A76FCA102..FALSE..$ex..A150AC403..FALSE..$ex..A1ABF3862..FALSE..$ex..A502E833A..FALSE..$ex..ACE56FB43..FALSE..$ex..A52B152B3..FALSE..$ex..AC0AC9330..FALSE..$ex..AE09F5A5F..FALSE..$ex..AF2F92670..FALSE..$ex..A94312164..FALSE..$ex..A5809A5D8..FALSE..$ex..A56A7DD7A..FALSE..$ex..A1A9DA512..FALSE..$ex..A84FEA59D..FALSE..$ex..A849003A2..FALSE..$ex..A98500B5D..FALSE..$ex..A4F27760E..FALSE..$ex..A4D56F533..FALSE..$ex..A7AA455DC..FALSE..$ex..AE1318D92..FALSE..$ex..A66980B9F..FALSE..$ex..A9167C40A..FALSE..$ex..A15F69ECD..FALSE..$ex..AB06B5044..FALSE..$ex..A66E41FEB..FALSE..$ex..A9E7D6EA9..FALSE..$ex..AB258770..FALSE..$ex..AB5CD4D0..FALSE..$ex..A537BC2C1..FALSE..$ex..A5D1665DA..FALSE..$ex..A6EB99A04..FALSE..$ex..AF5C9AD93..FALSE..$ex..A21D6E643..FALSE..$ex..A63D6488F..FALSE..$ex..AF835DFEA..FALSE..$ex..A9115C352..FALSE..$ex..A76FCA102..TRUE..$ex..P76FCA102_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..$

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF64.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF74.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\SETDF85.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET347.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET461.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\SET57C.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB68E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB69F.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\SETB6BF.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7C9.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7DA.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\SETA7EA.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Download File

Process:	C:\ProgramData\mia595B.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	5.452037061918955
Encrypted:	false
SSDEEP:	192:86NgV1xjau6XWFGkhjX39vXAT0iE9JLOV:tUa1XWFGkpqYiE9JyV
MD5:	1AE78E69FB2A29D9B2A7B40D6BB1C043
SHA1:	2B53F30E72C4A877434DD1DE4EC4D4DC613C1D22
SHA-256:	A62B45BB0DA159DCC5A117780F2CA6C01D5BC97C7A384F124AE8D3A8A10456E2
SHA-512:	F1B232C3D06148379F7A4104731530F253F5D77DFEA60D9BDFEFDC3514046ECFAFCB41AC7982537B947AA2960717FD476E0678321AE23B18C6B016B136E91B32
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\{C39D0~1\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\..$ex..AEDD97940..FALSE..$ex..A3CE6DECE..FALSE..$ex..A34E6DE3C..FALSE..$ex..A25D64044..FALSE..$ex..A3476C065..FALSE..$ex..A8135F827..FALSE..$ex..A8808A0B2..FALSE..$ex..ACC3273D..FALSE..$ex..AA913E6AF..FALSE..$ex..ACECD985D..FALSE..$ex..AC5D9D236..FALSE..$ex..A1A2661C4..FALSE..$ex..AC64028C1..FALSE..$ex..A3CEB12CD..FALSE..$ex..A1872974D..FALSE..$ex..AD4D85249..FALSE..$ex..AEACB8D8..FALSE..$ex..A7C4CDFEC..FALSE..$ex..A95FFAA1..FALSE..$ex..AF0FC8706..FALSE..$ex..AD7FB24C5..FALSE..$ex..A86D611ED..FALSE..$ex..AEDD97940..TRUE..$ex..PEDD97940_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A3CE6DECE..TRUE..$ex..P3CE6DECE_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A34E6DE3C..TRUE..$ex..P34E6DE3C_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A25D64044..TRUE..$ex..P25D64044_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A3476C0

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC583.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC593.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\SETC5B3.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET94ED.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET94FE.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\SET951E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E10.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E30.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\SET2E51.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\DPINST.LOG

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	39898
Entropy (8bit):	3.7274967042685225
Encrypted:	false
SSDEEP:	384:6PS0ScS6VDZSlSNSddAMSBSpS9dToQSxS5SIlY0SWS+SIFwrS3S/SL9pzSUS8SG4:6rD0AhToiYGwwpbMVR
MD5:	0F90C61EC5C8E6C272951CFE5E23CEE7
SHA1:	5D5857C9832B39B2379B3D0837D3CB438DE0E800
SHA-256:	37270A5C180CCB2DA89F3BD135A1A32F27A6AB8359A0DDBD44A68349A1E0ADAF
SHA-512:	43385FF58CDAED342BBE39671465BE441ABB49BD9ACDA81525CFEA71D665DB4B7834F1405F56092BB7D53B91A6860AF652C87E6839E6B533D18DD3A81C950C72
Malicious:	false
Preview:	..I.N.F.O.:. . . .............................................I.N.F.O.:. . . .0.3./.1.4./.2.0.2.4. .1.2.:.1.3.:.5.5.....I.N.F.O.:. . . .P.r.o.d.u.c.t. .V.e.r.s.i.o.n. .2...1...0...0.......I.N.F.O.:. . . .V.e.r.s.i.o.n.:. .6...2...9.2.0.0. .....I.N.F.O.:. . . .P.l.a.t.f.o.r.m. .I.D.:. .2. .(.N.T.).....I.N.F.O.:. . . .S.e.r.v.i.c.e. .P.a.c.k.:. .0...0.....I.N.F.O.:. . . .S.u.i.t.e.:. .0.x.0.1.0.0.,. .P.r.o.d.u.c.t. .T.y.p.e.:. .1.....I.N.F.O.:. . . .A.r.c.h.i.t.e.c.t.u.r.e.:. .A.M.D.6.4.......I.N.F.O.:. . . .I.n.t.e.r.a.c.t.i.v.e. .W.i.n.d.o.w.s. .S.t.a.t.i.o.n.....I.N.F.O.:. . . .C.o.m.m.a.n.d. .L.i.n.e.:. .'.C.:.\.P.R.O.G.R.A.~.3.\.{.C.D.C.C.2.~.1.\.O.F.F.L.I.N.E.\.m.D.I.F.x.I.D.E...d.l.l.\.x.6.4.D.P.I.n.s.t...e.x.e. . ./.S.W. ./.S.E. ./.E.L. ./.P.A.T.H. .C.:.\.P.R.O.G.R.A.~.1.\.\.T.E.C.H.K.O.~.1.\.T.E.C.H.K.O.~.1.\.D.E.N.S. ./.D. ./.S.A. ./.L.M. ./.F.'.....I.N.F.O.:. . . .D.P.I.n.s.t. .i.s. .n.o.t. .m.u.l.t.i.-.l.i.n.g.u.a.l.......I.N.F.O.:. . .

C:\Windows\INF\oem10.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem11.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem5.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem6.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem7.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem8.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem9.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	114043
Entropy (8bit):	5.382364942247263
Encrypted:	false
SSDEEP:	1536:O+5cdyeoiwGeRAstj63xRFG2eaaOvpUc+jK1V1vo:O+5cgeotRAstj63xRFG2eaaOveX
MD5:	CF6265C752C72FCD62533A95AA6EA814
SHA1:	43FFB64D0D134FA6EBFD36AD2BB452922CEEE322
SHA-256:	39D3CCD0DA805BEEFF3BACE55055A874A1AD3394EB51470C6B0FD58F0B48F989
SHA-512:	B42A44C4859ECA0C950CC7F2DDD0F0A3CDE6A4810128ACC77F61C7B079F89DACCC6310A789A87B5228E151D7C4247103F6C3875F7AEB3FC36D0505F243E5B7E5
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\5c6a91.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309153147556162
Encrypted:	false
SSDEEP:	12288:RZTHM4uBKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:RFM48x5BqPA2fc7wMz7
MD5:	A9CDCC1CCE934430F30F66BAF6118459
SHA1:	C53F64C4027301E8E94FAA739E3D59E593950854
SHA-256:	4EAEB8F7750D12B3CB411BC20BFF8A3948D977919B65A200B6AA58FC83D268B7
SHA-512:	82C938F3E64C3C88A7508BD9F3519D1FD803101B4EA12474C692585460FEA561D1FD9BD267B63C4F24301854E82DA3462BD4E4969E43277FD7AF48706B882176
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\5c6a95.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309153147556162
Encrypted:	false
SSDEEP:	12288:RZTHM4uBKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:RFM48x5BqPA2fc7wMz7
MD5:	A9CDCC1CCE934430F30F66BAF6118459
SHA1:	C53F64C4027301E8E94FAA739E3D59E593950854
SHA-256:	4EAEB8F7750D12B3CB411BC20BFF8A3948D977919B65A200B6AA58FC83D268B7
SHA-512:	82C938F3E64C3C88A7508BD9F3519D1FD803101B4EA12474C692585460FEA561D1FD9BD267B63C4F24301854E82DA3462BD4E4969E43277FD7AF48706B882176
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\5c6a96.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315742525627603
Encrypted:	false
SSDEEP:	12288:0to4wBKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:0to4ql5BqPA2fc7wMz7
MD5:	345DD7F8B98628179CF1E01A15B4C502
SHA1:	DF616AC0649525B0C0023C73B6C2DA6BCEFC9A23
SHA-256:	52B3F0E622DCC2DF803503DE301F7BA917F602F9F26F033184B2AB6151006E7A
SHA-512:	484FFD76D39E1C2D785238A381266D594DD0EA0A1BC9EA28F04672B8398790BF87680F7B947FDBEF4F3BD01E2356E905FB6E5E1953531DAD76F04649A1488721
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\5c6a99.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315742525627603
Encrypted:	false
SSDEEP:	12288:0to4wBKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:0to4ql5BqPA2fc7wMz7
MD5:	345DD7F8B98628179CF1E01A15B4C502
SHA1:	DF616AC0649525B0C0023C73B6C2DA6BCEFC9A23
SHA-256:	52B3F0E622DCC2DF803503DE301F7BA917F602F9F26F033184B2AB6151006E7A
SHA-512:	484FFD76D39E1C2D785238A381266D594DD0EA0A1BC9EA28F04672B8398790BF87680F7B947FDBEF4F3BD01E2356E905FB6E5E1953531DAD76F04649A1488721
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\MSI6BBA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSI6C57.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI6C97.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI6CC7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI6CF7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11785
Entropy (8bit):	5.789321257277549
Encrypted:	false
SSDEEP:	192:nHw9S/Q1WOcI8skxoCyRR3E0cqiZ1rFsI92uBYPiGjAeN4jWK:nHw9T1CyRRU0cqiZ1xh92UHWK
MD5:	D05B516141D15A015E647D9C7927AA8D
SHA1:	FD0221BD95ADF78EFCF43A7BD830093E2D0B5036
SHA-256:	4CDC680CB405BFF9139EEB2F07EA124BBDBDE31807AD516DF2E6272F7EAFBA30
SHA-512:	1531523EB8D7DF6538028C8AF914C7DC397970160FADF0965D1A07AE661789129D860637DCA408F309353B5AC6BDDA8F6A645B0178BE710C55A8766A5182D016
Malicious:	false
Preview:	...@IXOS.@.....@.anX.@.....@.....@.....@.....@.....@......&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}..TECHKON Device Service..TDService.msi.@.....@.....@.....@........\PROGRA~3\&.{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Service......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{CD0C69EF-2B12-47ED-87B7-5A1DB20CBCD9}N.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss.@.......@.....@.....@......&.{4D6F449F-FA68-42B5-A305-16C45F308B8F}N.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss.@.......@.....@.....@......&.{96ED6BF5-4AA1-4668-AEEE-E5101CDF29BA}L.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.@.......@.....@.....@......&.{672A692B-629D-4B2A-A63B-2E211EA7164C}N.C:\Program Files (x86)\TECHKON GmbH

C:\Windows\Installer\MSI8830.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSI88BE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI88FE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI891E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI897D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	16700
Entropy (8bit):	5.7232020073611025
Encrypted:	false
SSDEEP:	384:aeRHUzdHmO0GgJVAu6qMNv1oDZkXtQMDmDIzqZ1+CmC/jFz5G6ci40F1e3i0iwAz:a/zM3ygkTq
MD5:	8175BDCAF8C5BC35EE921664855BB10D
SHA1:	AEA339AC95308105030EA4AA0E4F549B16DE81A9
SHA-256:	077E7A9983CB3CAF712D61901748D68678E85D31C0C339353F72F4F8AF61F013
SHA-512:	585D8AA6DFCA760B4F8FB1AFEF7FD975FAAF1C4F888A2EAC200AB103E233CA6D7D5545A52F3FAEE4962153FF5F7A5323B8B792F878ED503AAC2AB41868C6D73E
Malicious:	false
Preview:	...@IXOS.@.....@.anX.@.....@.....@.....@.....@.....@......&.{55EA8940-B618-47BD-A642-20BFB2A64F78}..TECHKON Device Driver 64Bit..TechkonDriver64Bit.msi.@.....@.....@.....@........\PROGRA~3\&.{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Driver 64Bit......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@$....@.....@.]....&.{5702EAC5-033D-48B5-B83F-DEF9ECF4C262}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys.@.......@.....@.....@......&.{52B0046B-434A-4EA9-9AC7-766C93D4D3F6}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf.@.......@.....@.....@......&.{6D03A36D-9750-4B1E-8344-0CE7ACED2DE2}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat.@.......@.....@.....@......&.{2B8BCB22-4191-4BD5-817D-B0123E06B87F}T.C:

C:\Windows\Installer\SourceHash{55EA8940-B618-47BD-A642-20BFB2A64F78}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8075030516230908
Encrypted:	false
SSDEEP:	24:JhXIf908zkrC8HscELypUHOl050j9/ZVuNjJPUB//6FN:TS9zkrCP6UW052y6//6v
MD5:	906C4921E8117C2433F1E51D8850D403
SHA1:	50EB5DCA420A3090DBDA12011E076E12B95A05E4
SHA-256:	DAD112BD05F25FF3771F1E3076FB11A72B90B5284B2722D0EABF173C645E0A73
SHA-512:	1B91113DE86C58FCDB49B4776BB3DA3B6A21978476C2D6CF43A8072BC7003CF4C5B678E3E41AE9EBB9E733A1F3E0C9A4A53B806E248099DA857EBBAC99F6A076
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6294569573473938
Encrypted:	false
SSDEEP:	24:JWwXmIsc0d+R79GiQs5hBFyTUksTQ+F/ymZU+/w/FD+utO7KvFN:5WxcJ7ImBITdsT2AKvv
MD5:	8302126105F23FC1255A7F28FB9B7DE2
SHA1:	314A25EBD4639750BB68B8419B64C86F26BFA02E
SHA-256:	BCB8C62677236E9D304C011E423E4354E8D220189DEFF880394107D161276227
SHA-512:	37F37728F9B2EA6964EA0957E9E286F2631FD83C6B7BDD2587C7589AA92C55C28FCB72D8EA483F2F4D236F93B6CAFCEADEBDBB8464C927C8E4F6C8157D1131FC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4840872150632558
Encrypted:	false
SSDEEP:	48:g8PhbuRc06WXJGjT5oI4kTn3tZ/1Cfq6Oe0ZPfKOy:Phb1djTckT3D/1CnfuP9
MD5:	5C87BBF9518BEA3CA784D43B77AE488F
SHA1:	A8237B993E84F2F2FFC9370D7B8FBCAFF3B51974
SHA-256:	9571DD7413AF61534916D5824F7A0B49352A5C296530472DA6B5900E46CACE3C
SHA-512:	4E84E78DC5CA7FC20FCCB8B15C80A8CB09EC280353E2105D1D06B35C140ECA03B1DFEA53405D8FE28877321C60B24A67CA970EE016DFAD9329F084C6BE8EB06D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365498997702745
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauZ:zTtbmkExhMJCIpE6
MD5:	DD91532C14704A55B2E7F42213322B87
SHA1:	126D52E58F03DD4D0D01C30140786D910C776DF5
SHA-256:	B145E57760E1B6B6283FA5E8EAF2DC0AE9BE9D313154132A5C4AC12023D7F1C0
SHA-512:	30E2ED1B67407F749A486FF52B2C6A4720431AFEAB2C736DB7671F684D269ECD7E15914BDA9E42BA9624CBBEF390CCC971B47F75FD98F4DEE9E106B5500C7580
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\MSWINSCK.OCX

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\TDSCON.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.853209211745096
Encrypted:	false
SSDEEP:	1536:YxeYFH0dtYcPdtYc0F9J174KlwOAYQog4wBYo4IYo4N65xpUV:YTFXNxF9j7j65xpUV
MD5:	9AA2C7DEAF5B8DBED62A60F723553858
SHA1:	6BFE53D07A3970523DC8C796EE24F392D2686BF7
SHA-256:	28D0E73EE5616C2A76829A0A430F465B598987B4798F6BA46234393E40167BA9
SHA-512:	AF2C404702563143B3ED6FC26C45D4E1CBB074F006420FF04F963C1F13783CA141C13D08918AFA9537A2DAABABC631C18DBB6562BC50AA3CB49294CCD00714F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......UBq..#...#...#...?...#..^....#..'....#.......#..Rich.#..........PE..L...Y..J...........!.........@......(........................................@......"J..........................................(.......D....................0..............................................X... .......(............................text............................... ..`.data...H...........................@....rsrc...D........ ..................@..@.reloc.......0.......0..............@..B2..H............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\USBIOCOM.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.031963137664287
Encrypted:	false
SSDEEP:	3072:LwlZ+P6imnm8mFmT73tgHnV53kAgcvzgRm1trohJkwh:cZ+6imnm8mFmT73krb6gonf
MD5:	CEC1791BEC45F9D86771AF4F24EAA3F4
SHA1:	1B806C9A7189C7801EF643C5AEA03CD6B0DEDCC4
SHA-256:	7878EB862C0A8AB0766236E6C2183FAC93A0C734276347A143B454E2FB8B4F58
SHA-512:	BF917BA4C20DB97685A4BFEA266ECE11C77286F9480E546007FC1D830E4DFBA0966F6B5B59D74AFC89713276BB899755DFABC8F3C42A8422E612401C761A9BE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.v.v.v.Y.v.v.Y.v...v"..v.v"..v.v.vE..v.Y.v..v.Y.v...v.Y.v...v.Y.v...vRich.v........PE..L...Q..K...........!.....`...P...............p......................................[...............................0................0..................................................................@............p..l............................text...._.......`.................. ..`.rdata...x...p.......p..............@..@.data....9....... ..................@....rsrc........0......................@..@.reloc..V'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\lcms.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.4058590918443175
Encrypted:	false
SSDEEP:	6144:U+l+8gbiTF32Cw0oSGWhuLuGser+VbGrIQL:idbgFmJSGWhWuGseapkr
MD5:	05D89328C51E732DE076DA05239D1D79
SHA1:	C89B8500D13D540D9F6D8FA651F13E2F9990DECE
SHA-256:	EE0BC472EC26CE050315AAAE1D85AE51BAF17E8A2A548E3161DED665CF324DD1
SHA-512:	9EFE29F322A0A3049D0E5332C92A434B2F9797C0D3DB09414FCF8D6F5A01C4157716D5D252B38879312D5675712AD875B2A8D7E9407849CE1B992B94D5E50FF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9K!3}O`}O`}O`.5D`\|O`.6A``O`.5E`.O`.5\`xO`}N`3O`{.E`iO`.,I`\|O`..K`\|O`Rich}*O`........................PE..L......B...........!.....p..........w...................................................................................W.......<....`.......................p.......................................................................................text....k.......p.................. ..`.rdata...(.......0..................@..@.data...X........`..................@....rsrc........`......................@..@.reloc.......p... ... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SET9DF.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SETA0E.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\SETA2F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{30f5102e-ba4d-fb49-b3b3-10ebc04c2be4}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE1E4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE1F5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\SETE215.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{5ffce88b-5d36-134d-9774-6562c8b1bb19}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC94B.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC99A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\SETC9AB.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{7b9975a3-1615-624f-909c-3def7f6b1f3d}\spectrojet_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB844.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB855.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\SETB875.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{8e8837bf-ff02-614c-8e7a-b11b44ac36ff}\spectroplate_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B08.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B28.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\SET9B38.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{9ccfaa64-2bee-634c-b74d-8157966ed19d}\dens_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET30FE.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET311E.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\SET313F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c3ecf213-5717-4245-af4a-4040958206cd}\spectrojet_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET19EC.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET1A1C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\SET1A7B.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c963bf1b-f2fe-ff4c-9e09-0dcb6f3d7b7a}\spectrodens_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA96F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA99F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\SETA9B0.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{f09e7a60-0e8b-a74a-a66b-6aa4b1d719a9}\spectrodens_ir_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4597
Entropy (8bit):	5.319787503082901
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNbG6SlEEN:QO00eO00erMwmkB1kAhG6SlEEN
MD5:	8F14070C9D76778BF5F7BB9223541D82
SHA1:	78CA05131AC8EB5F58C458FBCCD1FE8117644F80
SHA-256:	738461F8030D91A0F8494732DAAED78DEAD04F9256A784EADA07D4575ED675D1
SHA-512:	21767BD1D5D0CED358FDA28925078E9DBC7130CD5505A90E3C75AFEB19A3A0C585FF51A439ECB3897A6337969D91667EBE6039C0424EE6637030C15BD71EAD81
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\Temp\~DF033F044C5B27E32D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0F102AA07B969D02.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF209F756E5E35AC81.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7880233224595616
Encrypted:	false
SSDEEP:	192:YMX6O1BgkSnuYb/jg5Bt+iSbjDXc4jKDZ4K/pYo:YCxB+nuabg5BZIDXSDZF/
MD5:	985A37D448C9CBF0DDC0D3C6D276B7EE
SHA1:	09FC53269B72A27449D703B54E9AD49D8B06EA19
SHA-256:	F3F8403C84BCCC32699E805DFF7623AA74453F0555B3F4523DF3B16507086E0C
SHA-512:	81B795F60E1B443D506F09E9F80F98C3DB7A822A343073DE7DBCBD6BD3EA0C82212BA8DF04F44B98E728EA4CF2EADF8E0FAFF1B225F163CF710BC705DF63F9C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF347C1EBDA873FAAE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4840872150632558
Encrypted:	false
SSDEEP:	48:g8PhbuRc06WXJGjT5oI4kTn3tZ/1Cfq6Oe0ZPfKOy:Phb1djTckT3D/1CnfuP9
MD5:	5C87BBF9518BEA3CA784D43B77AE488F
SHA1:	A8237B993E84F2F2FFC9370D7B8FBCAFF3B51974
SHA-256:	9571DD7413AF61534916D5824F7A0B49352A5C296530472DA6B5900E46CACE3C
SHA-512:	4E84E78DC5CA7FC20FCCB8B15C80A8CB09EC280353E2105D1D06B35C140ECA03B1DFEA53405D8FE28877321C60B24A67CA970EE016DFAD9329F084C6BE8EB06D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF374959924A06FA06.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3B8FBE54F2683E01.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF406720EBD5081C6E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.5374529133758259
Encrypted:	false
SSDEEP:	24:/bF0mlrC8HscELypUHOl050j9/ZVuNjJPUB//:/bamlrCP6UW052y6//
MD5:	5FB0A0CADAE94A002BDD67702FF5BB9A
SHA1:	165DB6CFF72B876FDA0B60F2009F614048103EE3
SHA-256:	76B485E997A84F2DD9CEAA87099EBD6A7C545C8C89BD194389B5CCD1B2679854
SHA-512:	4641709FCE466F043C385617AD6A750D139799E6B0B8F73D1FC9F4B86AD4AD919FBCE9A2AF3824FF5E7A13AA8E4AC908ADC84DBA255FBB0325232AE7EA3318EB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF45844022C99AFF3D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5F7E3960908BC431.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF66B08A2FC550D0D7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7619F2B189BEB758.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.7394886096731401
Encrypted:	false
SSDEEP:	192:0xnuYT1BgkL/jg5Bt+iSbjDXc4jKDZ4K/pY:WnueBPbg5BZIDXSDZF/
MD5:	8096ECE3C7ECB94E6FA1930C532FB976
SHA1:	F346919BE5549FF5EF9E56CE6C70875D812E673C
SHA-256:	53412674F309EA3D605338808AE526803858CDEEDC363B57D2A54244EF23008B
SHA-512:	15A6C8E2731E7013697250D28AFB1CF52D9F5C9CEEAEA046CA5487A328E3443A98C5FED55776FF294C6AC784ABD09919C2D8F62BBF81EE26EAD732568DDFAF9F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF86CD081F73180C3C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0099810753974103
Encrypted:	false
SSDEEP:	192:OiJS9OqGg5Bt+7SsoDi7BYhEsDo1SAlmo/+Y7UYXmcMAcAYAiAbAOAAsjqpSjwli:OSeOFg5BEKDiEDo1SA7/TzZFXkzsQx
MD5:	392CD1A81780603990767B17C3FE5ED6
SHA1:	6AB3C88D8016160DC5E908D30A50D064C9707940
SHA-256:	09B7C63D9872309F48C036E5053F6D9DF0468C9AEB118B59C51BB3BD849829E0
SHA-512:	20F4523D5BC749DB253847D62AF50ACFB6EA4D883A11A3613EE083576FDD74EFF8E4F57CD8A89E5EE9DCB5676BE5B6E8938E8344E64906EA55782CD621CD2509
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF95DE63B390DA77AB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF966301E4EA38730D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	0.868868234902423
Encrypted:	false
SSDEEP:	192:suOYXmcMAcAYAiAbAOAAsjqpSjwlJy/Aa8BAx3ZqGg5Bt+7SsoDi7BYhEsDo1SAp:sezZFXkzsQxpFg5BEKDiEDo1SA7/
MD5:	F869EF87EC219C6A0E2F1CA6272EDFD8
SHA1:	59F66F675CB116E235986C3A1D582AAE619FA9A9
SHA-256:	91C6AD28303F0B8A0073B843A37A50A15456DED6390325CAF05CE31AE08FE14D
SHA-512:	7559539B32D0CEC366B4C00FF6334F6FF99B17477A96CB7ED93C3A5E688FDE7F9C6EF5915FE544C056B0DEA65BA604191554EC13DBAF96D4CC20C0130C4E607D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAABFEFFF6546216E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0099810753974103
Encrypted:	false
SSDEEP:	192:OiJS9OqGg5Bt+7SsoDi7BYhEsDo1SAlmo/+Y7UYXmcMAcAYAiAbAOAAsjqpSjwli:OSeOFg5BEKDiEDo1SA7/TzZFXkzsQx
MD5:	392CD1A81780603990767B17C3FE5ED6
SHA1:	6AB3C88D8016160DC5E908D30A50D064C9707940
SHA-256:	09B7C63D9872309F48C036E5053F6D9DF0468C9AEB118B59C51BB3BD849829E0
SHA-512:	20F4523D5BC749DB253847D62AF50ACFB6EA4D883A11A3613EE083576FDD74EFF8E4F57CD8A89E5EE9DCB5676BE5B6E8938E8344E64906EA55782CD621CD2509
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB74582C6527E0424.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40614039489726417
Encrypted:	false
SSDEEP:	24:/jF0ml79GiQs5hBFyTUksTQ+F/ymZU+/w/FD+utO7K:/jaml7ImBITdsT2AK
MD5:	FC8A5270080D9CE42A504303951AC7D6
SHA1:	042616BBCE125331BA037AF6AD345ED31AF599CD
SHA-256:	9B0E261C997EB0E1575311939243823559870468E9FA260D749B611047F7B0D2
SHA-512:	698C6396D746722CFDEFC0F5195ACB377FB5FD417C9F0963C28775FDBC1CC49DD08AA36A900E0BB05DCC2E74E3D54086C342773B2A614E5416CBC8401FAFD675
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC224660F871CBE9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC2D58A49A1568575.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7880233224595616
Encrypted:	false
SSDEEP:	192:YMX6O1BgkSnuYb/jg5Bt+iSbjDXc4jKDZ4K/pYo:YCxB+nuabg5BZIDXSDZF/
MD5:	985A37D448C9CBF0DDC0D3C6D276B7EE
SHA1:	09FC53269B72A27449D703B54E9AD49D8B06EA19
SHA-256:	F3F8403C84BCCC32699E805DFF7623AA74453F0555B3F4523DF3B16507086E0C
SHA-512:	81B795F60E1B443D506F09E9F80F98C3DB7A822A343073DE7DBCBD6BD3EA0C82212BA8DF04F44B98E728EA4CF2EADF8E0FAFF1B225F163CF710BC705DF63F9C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCAECB3649EC8E508.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.3505636063378956
Encrypted:	false
SSDEEP:	192:f1z+1BgkSnuYb/jg5Bt+iSbjDXc4jKDZ4K/pYo:fpSB+nuabg5BZIDXSDZF/
MD5:	65220081FEAB63472C30B955AB889C98
SHA1:	6C36BEE649EFCFB77BBAFA7FA002BBE24EB66E6F
SHA-256:	B86D3F66C5064C209808E80C8B32A65968600DCEBCF113D9863C33600774B0DC
SHA-512:	CD8BC624F81E2FBFA612286A6D5F0A2EFCE3404F41360CDA7726B681477E124F4B80EE53FD7C53F11DB2858894B9F7C9559EA10260F28276232C3E6C7F16B477
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCEACDE85F7080B48.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.3505636063378956
Encrypted:	false
SSDEEP:	192:f1z+1BgkSnuYb/jg5Bt+iSbjDXc4jKDZ4K/pYo:fpSB+nuabg5BZIDXSDZF/
MD5:	65220081FEAB63472C30B955AB889C98
SHA1:	6C36BEE649EFCFB77BBAFA7FA002BBE24EB66E6F
SHA-256:	B86D3F66C5064C209808E80C8B32A65968600DCEBCF113D9863C33600774B0DC
SHA-512:	CD8BC624F81E2FBFA612286A6D5F0A2EFCE3404F41360CDA7726B681477E124F4B80EE53FD7C53F11DB2858894B9F7C9559EA10260F28276232C3E6C7F16B477
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD01868AB2D9A18E9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD89E5F534389A5A9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4840872150632558
Encrypted:	false
SSDEEP:	48:g8PhbuRc06WXJGjT5oI4kTn3tZ/1Cfq6Oe0ZPfKOy:Phb1djTckT3D/1CnfuP9
MD5:	5C87BBF9518BEA3CA784D43B77AE488F
SHA1:	A8237B993E84F2F2FFC9370D7B8FBCAFF3B51974
SHA-256:	9571DD7413AF61534916D5824F7A0B49352A5C296530472DA6B5900E46CACE3C
SHA-512:	4E84E78DC5CA7FC20FCCB8B15C80A8CB09EC280353E2105D1D06B35C140ECA03B1DFEA53405D8FE28877321C60B24A67CA970EE016DFAD9329F084C6BE8EB06D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDA0C224C294CA707.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7880233224595616
Encrypted:	false
SSDEEP:	192:YMX6O1BgkSnuYb/jg5Bt+iSbjDXc4jKDZ4K/pYo:YCxB+nuabg5BZIDXSDZF/
MD5:	985A37D448C9CBF0DDC0D3C6D276B7EE
SHA1:	09FC53269B72A27449D703B54E9AD49D8B06EA19
SHA-256:	F3F8403C84BCCC32699E805DFF7623AA74453F0555B3F4523DF3B16507086E0C
SHA-512:	81B795F60E1B443D506F09E9F80F98C3DB7A822A343073DE7DBCBD6BD3EA0C82212BA8DF04F44B98E728EA4CF2EADF8E0FAFF1B225F163CF710BC705DF63F9C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE04C7A904F70C2AD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0099810753974103
Encrypted:	false
SSDEEP:	192:OiJS9OqGg5Bt+7SsoDi7BYhEsDo1SAlmo/+Y7UYXmcMAcAYAiAbAOAAsjqpSjwli:OSeOFg5BEKDiEDo1SA7/TzZFXkzsQx
MD5:	392CD1A81780603990767B17C3FE5ED6
SHA1:	6AB3C88D8016160DC5E908D30A50D064C9707940
SHA-256:	09B7C63D9872309F48C036E5053F6D9DF0468C9AEB118B59C51BB3BD849829E0
SHA-512:	20F4523D5BC749DB253847D62AF50ACFB6EA4D883A11A3613EE083576FDD74EFF8E4F57CD8A89E5EE9DCB5676BE5B6E8938E8344E64906EA55782CD621CD2509
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992773034922727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8ue90oYkrv.exe
File size:	13'453'632 bytes
MD5:	5a0d2bc66c17c640e81233cf6a200e07
SHA1:	65ab84dc66feb7b7034ec5713b68fd39a6cd1a01
SHA256:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
SHA512:	702c862e10b31a7c14fa1c9d63d42b5710d5a7392b5acbb0ebb4605d8c92f77dd08b69234eea99a5fc7031fa337173e3c7f45547e0cc1e0e17465a6fbd110743
SSDEEP:	196608:uv/Ubmek67xSg9uXs1MAsG3UiKC0NWzqi3aumj37RtXuC9/RyXBNQeGvcGqR3q8H:g8aejfucanjC0NNtp37RdZeBNKvcGkfz
TLSH:	8DD63322F3EE8271FCB36EB859B18BAA462778119F35D6DF6348095D5E322C05A74313
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U...

File Icon


Icon Hash:	3e5bec56762e350b

Static PE Info

General

Entrypoint:	0x421bd6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x55EF5AD2 [Tue Sep 8 22:01:54 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	eaefd1169420dcee9fef7c65aa268740

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/03/2014 01:00:00 03/06/2017 01:59:59
Subject Chain	CN=TECHKON GmbH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TECHKON GmbH, L=Koenigstein, S=Hessen, C=DE
Version:	3
Thumbprint MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
Thumbprint SHA-1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
Thumbprint SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
Serial:	2C68B7C967BB304C0C911BB4D3311D95

Entrypoint Preview

Instruction
call 00007F7ED52CE2C6h
jmp 00007F7ED52CAC5Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004393B8h], eax
mov dword ptr [004393B4h], ecx
mov dword ptr [004393B0h], edx
mov dword ptr [004393ACh], ebx
mov dword ptr [004393A8h], esi
mov dword ptr [004393A4h], edi
mov word ptr [004393D0h], ss
mov word ptr [004393C4h], cs
mov word ptr [004393A0h], ds
mov word ptr [0043939Ch], es
mov word ptr [00439398h], fs
mov word ptr [00439394h], gs
pushfd
pop dword ptr [004393C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004393BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004393C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004393CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00439308h], 00010001h
mov eax, dword ptr [004393C0h]
mov dword ptr [004392BCh], eax
mov dword ptr [004392B0h], C0000409h
mov dword ptr [004392B4h], 00000001h
mov eax, dword ptr [00437024h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00437028h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000098h]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x360e8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x1b0c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xcd3020	0x1920
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30e10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x264	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2cb9d	0x2cc00	08b1425d0c235f73ec2fd58abfe6486d	False	0.5150412447625698	data	6.487113973217182	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0x8e28	0x9000	2493c37a97f6e172b3dd001b1af0d594	False	0.3415256076388889	data	4.651109246510969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x8300	0x2400	5b956e9eb3e2cde75a854ea16ed7c543	False	0.2583550347222222	data	4.183030383074928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40000	0x1b0c8	0x1b200	0776982004dfe8682cdafdb0e01c538b	False	0.2710883496543779	data	4.541515290825601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x40d14	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.35261194029850745
RT_ICON	0x41bbc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.36236462093862815
RT_ICON	0x42464	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3302023121387283
RT_ICON	0x429cc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.27842323651452283
RT_ICON	0x44f74	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3557692307692308
RT_ICON	0x4601c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4512411347517731
RT_DIALOG	0x46484	0x1d8	data			0.5720338983050848
RT_DIALOG	0x4665c	0x1be	data			0.5605381165919282
RT_DIALOG	0x4681c	0x54	data			0.7619047619047619
RT_STRING	0x46870	0x478	Matlab v4 mat-file (little endian) D\006'\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.2972027972027972
RT_STRING	0x46ce8	0x5ba	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Catalan	Spain	0.252387448840382
RT_STRING	0x472a4	0x1ca	Matlab v4 mat-file (little endian) !q\325luR\372^\207e\366N>Y , numeric, rows 0, columns 0	Chinese	Taiwan	0.5131004366812227
RT_STRING	0x47470	0x4ea	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Czech	Czech Republic	0.2845786963434022
RT_STRING	0x4795c	0x4d6	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Danish	Denmark	0.2689822294022617
RT_STRING	0x47e34	0x6b6	Matlab v4 mat-file (little endian) O, numeric, rows 0, columns 0	German	Germany	0.2409778812572759
RT_STRING	0x484ec	0x596	Matlab v4 mat-file (little endian) \224\003\265\003\275\003 , numeric, rows 0, columns 0	Greek	Greece	0.2853146853146853
RT_STRING	0x48a84	0x48c	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	English	United States	0.27405498281786944
RT_STRING	0x48f10	0x57c	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	Finnish	Finland	0.24287749287749288
RT_STRING	0x4948c	0x63c	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	French	France	0.22807017543859648
RT_STRING	0x49ac8	0x370	Matlab v4 mat-file (little endian) ', numeric, rows 0, columns 0	Hebrew	Israel	0.33636363636363636
RT_STRING	0x49e38	0x4c6	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Hungarian	Hungary	0.29705400981996727
RT_STRING	0x4a300	0x528	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	Italian	Italy	0.25227272727272726
RT_STRING	0x4a828	0x2c6	Matlab v4 mat-file (little endian) \3250\2510\3530\3000 , numeric, rows 0, columns 0	Japanese	Japan	0.4295774647887324
RT_STRING	0x4aaf0	0x290	Matlab v4 mat-file (little endian) \364\323T\263\|\271 , numeric, rows 0, columns 0	Korean	North Korea	0.4634146341463415
RT_STRING	0x4aaf0	0x290	Matlab v4 mat-file (little endian) \364\323T\263\|\271 , numeric, rows 0, columns 0	Korean	South Korea	0.4634146341463415
RT_STRING	0x4ad80	0x5b2	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Dutch	Netherlands	0.2496570644718793
RT_STRING	0x4b334	0x496	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Norwegian	Norway	0.2632027257240204
RT_STRING	0x4b7cc	0x4bc	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Polish	Poland	0.2838283828382838
RT_STRING	0x4bc88	0x5a6	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Brazil	0.25311203319502074
RT_STRING	0x4c230	0x582	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Romanian	Romania	0.2581560283687943
RT_STRING	0x4c7b4	0x52c	data	Russian	Russia	0.2809667673716012
RT_STRING	0x4cce0	0x47a	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Croatian	Croatia	0.27486910994764396
RT_STRING	0x4d15c	0x506	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Slovak	Slovakia	0.2690513219284603
RT_STRING	0x4d664	0x4be	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Swedish	Sweden	0.25617792421746294
RT_STRING	0x4db24	0x458	Matlab v4 mat-file (little endian) D\016!\016H\016\0162\016!\0162\016#\016\026\016\016#\016I\0162\016\007\016B\016\037\016%\016@\016\024\016-\016#\016L\016D\016\024\016I\016 , numeric, rows 0, columns 0	Thai	Thailand	0.3255395683453237
RT_STRING	0x4df7c	0x3fc	Matlab v4 mat-file (little endian) ', numeric, rows 0, columns 0	Turkish	Turkey	0.31862745098039214
RT_STRING	0x4e378	0x5b6	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Slovenian	Slovenia	0.25239398084815323
RT_STRING	0x4e930	0x4ea	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	Estonian	Estonia	0.2599364069952305
RT_STRING	0x4ee1c	0x578	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Latvian	Lativa	0.25642857142857145
RT_STRING	0x4f394	0x4b8	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Lithuanian	Lithuania	0.2814569536423841
RT_STRING	0x4f84c	0x484	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Vietnamese	Vietnam	0.24567474048442905
RT_STRING	0x4fcd0	0x590	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Basque	France	0.25280898876404495
RT_STRING	0x4fcd0	0x590	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Basque	Spain	0.25280898876404495
RT_STRING	0x50260	0x1ca	Matlab v4 mat-file (little endian) \340e\325l\033R\372^\207e\366N9Y , numeric, rows 0, columns 0	Chinese	China	0.5131004366812227
RT_STRING	0x5042c	0x61c	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Portugal	0.2289002557544757
RT_STRING	0x50a48	0x5fc	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0			0.24216710182767623
RT_STRING	0x51044	0x27e	data	Arabic	Saudi Arabia	0.46551724137931033
RT_STRING	0x512c4	0x39e	data	Catalan	Spain	0.3941684665226782
RT_STRING	0x51664	0xea	data	Chinese	Taiwan	0.8333333333333334
RT_STRING	0x51750	0x302	data	Czech	Czech Republic	0.4701298701298701
RT_STRING	0x51a54	0x326	data	Danish	Denmark	0.413151364764268
RT_STRING	0x51d7c	0x442	data	German	Germany	0.38073394495412843
RT_STRING	0x521c0	0x376	data	Greek	Greece	0.43115124153498874
RT_STRING	0x52538	0x2f2	data	English	United States	0.42572944297082227
RT_STRING	0x5282c	0x31c	data	Finnish	Finland	0.4258793969849246
RT_STRING	0x52b48	0x3de	AmigaOS bitmap font "r", fc_YSize 29184, 17664 elements, 2nd "u", 3rd "'"	French	France	0.36666666666666664
RT_STRING	0x52f28	0x24c	data	Hebrew	Israel	0.4574829931972789
RT_STRING	0x53174	0x342	AmigaOS bitmap font "s", fc_YSize 24832, 18688 elements, 2nd "b", 3rd "n"	Hungarian	Hungary	0.42206235011990406
RT_STRING	0x534b8	0x3aa	data	Italian	Italy	0.3699360341151386
RT_STRING	0x53864	0x1cc	data	Japanese	Japan	0.6804347826086956
RT_STRING	0x53a30	0x1a4	data	Korean	North Korea	0.7452380952380953
RT_STRING	0x53a30	0x1a4	data	Korean	South Korea	0.7452380952380953
RT_STRING	0x53bd4	0x37c	AmigaOS bitmap font "n", fc_YSize 29184, 20224 elements, 2nd ".", 3rd "*"	Dutch	Netherlands	0.40358744394618834
RT_STRING	0x53f50	0x324	data	Norwegian	Norway	0.4166666666666667
RT_STRING	0x54274	0x372	data	Polish	Poland	0.42063492063492064
RT_STRING	0x545e8	0x38e	data	Portuguese	Brazil	0.38461538461538464
RT_STRING	0x54978	0x39e	data	Romanian	Romania	0.4136069114470842
RT_STRING	0x54d18	0x35a	data	Russian	Russia	0.42424242424242425
RT_STRING	0x55074	0x2de	data	Croatian	Croatia	0.4223433242506812
RT_STRING	0x55354	0x340	data	Slovak	Slovakia	0.4338942307692308
RT_STRING	0x55694	0x310	data	Swedish	Sweden	0.42346938775510207
RT_STRING	0x559a4	0x2be	data	Thai	Thailand	0.47293447293447294
RT_STRING	0x55c64	0x2a6	AmigaOS bitmap font "i", fc_YSize 30208, 16896 elements, 2nd "z", 3rd " "	Turkish	Turkey	0.46607669616519176
RT_STRING	0x55f0c	0x380	data	Slovenian	Slovenia	0.39285714285714285
RT_STRING	0x5628c	0x33a	data	Estonian	Estonia	0.4067796610169492
RT_STRING	0x565c8	0x374	data	Latvian	Lativa	0.4117647058823529
RT_STRING	0x5693c	0x31a	AmigaOS bitmap font "e", fc_YSize 25600, 19968 elements, 2nd "p", 3rd "o"	Lithuanian	Lithuania	0.43828715365239296
RT_STRING	0x56c58	0x2ba	data	Vietnamese	Vietnam	0.39111747851002865
RT_STRING	0x56f14	0x36a	data	Basque	France	0.41533180778032036
RT_STRING	0x56f14	0x36a	data	Basque	Spain	0.41533180778032036
RT_STRING	0x57280	0xe8	data	Chinese	China	0.8362068965517241
RT_STRING	0x57368	0x3d2	data	Portuguese	Portugal	0.3834355828220859
RT_STRING	0x5773c	0x3ae	data			0.37579617834394907
RT_STRING	0x57aec	0xee	data	Arabic	Saudi Arabia	0.592436974789916
RT_STRING	0x57bdc	0x12c	data	Catalan	Spain	0.5133333333333333
RT_STRING	0x57d08	0x92	data	Chinese	Taiwan	0.678082191780822
RT_STRING	0x57d9c	0xf8	data	Czech	Czech Republic	0.5604838709677419
RT_STRING	0x57e94	0xf4	data	Danish	Denmark	0.5450819672131147
RT_STRING	0x57f88	0x10e	data	German	Germany	0.5
RT_STRING	0x58098	0x10c	data	Greek	Greece	0.5970149253731343
RT_STRING	0x581a4	0x106	data	English	United States	0.5076335877862596
RT_STRING	0x582ac	0xe4	data	Finnish	Finland	0.5175438596491229
RT_STRING	0x58390	0x144	data	French	France	0.48148148148148145
RT_STRING	0x584d4	0xd4	data	Hebrew	Israel	0.6084905660377359
RT_STRING	0x585a8	0xfe	data	Hungarian	Hungary	0.531496062992126
RT_STRING	0x586a8	0x122	data	Italian	Italy	0.503448275862069
RT_STRING	0x587cc	0xa6	data	Japanese	Japan	0.6807228915662651
RT_STRING	0x58874	0xaa	data	Korean	North Korea	0.7352941176470589
RT_STRING	0x58874	0xaa	data	Korean	South Korea	0.7352941176470589
RT_STRING	0x58920	0xf4	data	Dutch	Netherlands	0.5122950819672131
RT_STRING	0x58a14	0x106	data	Norwegian	Norway	0.5114503816793893
RT_STRING	0x58b1c	0xea	data	Polish	Poland	0.5341880341880342
RT_STRING	0x58c08	0x10a	data	Portuguese	Brazil	0.49624060150375937
RT_STRING	0x58d14	0x12c	data	Romanian	Romania	0.49
RT_STRING	0x58e40	0x114	data	Russian	Russia	0.5398550724637681
RT_STRING	0x58f54	0xf2	data	Croatian	Croatia	0.5743801652892562
RT_STRING	0x59048	0xf8	data	Slovak	Slovakia	0.5483870967741935
RT_STRING	0x59140	0x134	data	Swedish	Sweden	0.4318181818181818
RT_STRING	0x59274	0x118	data	Thai	Thailand	0.5285714285714286
RT_STRING	0x5938c	0xf2	data	Turkish	Turkey	0.5619834710743802
RT_STRING	0x59480	0x11e	data	Slovenian	Slovenia	0.5104895104895105
RT_STRING	0x595a0	0xee	data	Estonian	Estonia	0.542016806722689
RT_STRING	0x59690	0x110	data	Latvian	Lativa	0.5257352941176471
RT_STRING	0x597a0	0xec	data	Lithuanian	Lithuania	0.5720338983050848
RT_STRING	0x5988c	0x10a	data	Vietnamese	Vietnam	0.5037593984962406
RT_STRING	0x59998	0x138	data	Basque	France	0.46794871794871795
RT_STRING	0x59998	0x138	data	Basque	Spain	0.46794871794871795
RT_STRING	0x59ad0	0x92	data	Chinese	China	0.6575342465753424
RT_STRING	0x59b64	0x122	data	Portuguese	Portugal	0.49310344827586206
RT_STRING	0x59c88	0x132	data			0.48366013071895425
RT_GROUP_ICON	0x59dbc	0x5a	data	English	United States	0.7
RT_VERSION	0x59e18	0xe40	data	English	United States	0.11677631578947369
RT_MANIFEST	0x5ac58	0x470	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4507042253521127

Imports

DLL	Import
KERNEL32.dll	GetLastError, ResetEvent, CreateEventW, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, GetModuleFileNameW, FormatMessageW, LocalFree, GetWindowsDirectoryW, CreateFileW, SetFileTime, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryW, DeleteFileW, GetShortPathNameW, GetFullPathNameW, lstrlenW, GetCurrentDirectoryW, GetTempFileNameW, FindClose, FindFirstFileW, FindNextFileW, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, DeleteCriticalSection, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, Sleep, LocalAlloc, SetCurrentDirectoryW, GetVersion, GetCommandLineW, CreateProcessW, GetExitCodeProcess, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetLocaleInfoA, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, LoadLibraryA, RaiseException, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, GetVersionExW, VirtualAlloc, WaitForMultipleObjects, VirtualFree, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, HeapSize, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, HeapFree, HeapAlloc, ExitThread, CreateThread, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetModuleHandleW, GetProcAddress, ExitProcess, GetModuleFileNameA, TlsGetValue, TlsAlloc
USER32.dll	SetForegroundWindow, CharUpperW, DestroyWindow, RegisterWindowMessageW, AdjustWindowRect, LoadImageW, KillTimer, SetTimer, PostMessageW, EndDialog, IsDlgButtonChecked, SetDlgItemTextW, GetDlgItem, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, LoadStringW, DialogBoxParamW, CreateDialogParamW, SystemParametersInfoW, PeekMessageW, GetDesktopWindow, MessageBoxW, SendMessageW, GetWindowLongW, SetWindowLongW, ShowWindow, MoveWindow, GetWindowRect, LoadIconW
GDI32.dll	GetObjectW
ADVAPI32.dll	RegSetValueExW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	ShellExecuteExW, SHGetFolderPathW
ole32.dll	CoInitialize, CoCreateInstance
OLEAUT32.dll	SysAllocStringLen, SysFreeString, VariantClear, SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Catalan	Spain
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Romanian	Romania
Russian	Russia
Croatian	Croatia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Slovenian	Slovenia
Estonian	Estonia
Latvian	Lativa
Lithuanian	Lithuania
Vietnamese	Vietnam
Chinese	China
Portuguese	Portugal

Target ID:	0
Start time:	12:13:41
Start date:	14/03/2024
Path:	C:\Users\user\Desktop\8ue90oYkrv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\8ue90oYkrv.exe
Imagebase:	0x400000
File size:	13'453'632 bytes
MD5 hash:	5A0D2BC66C17C640E81233CF6A200E07
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:13:43
Start date:	14/03/2024
Path:	C:\ProgramData\mia595B.tmp\TDService.exe
Wow64 process (32bit):	true
Commandline:	.\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""
Imagebase:	0x400000
File size:	5'295'078 bytes
MD5 hash:	A94A3D60FA8A54AB71ABED39D5883D86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000000.2039012583.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\mia595B.tmp\TDService.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:13:45
Start date:	14/03/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff77fc80000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:13:46
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding F1FA5532D1DD3919F4D531B46B734EEE
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:13:47
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:13:47
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:13:47
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:13:47
Start date:	14/03/2024
Path:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe"
Imagebase:	0x440000
File size:	1'150'976 bytes
MD5 hash:	F00223A56D3F89627CC88625DBCB0C42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 2%, ReversingLabs Detection: 6%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:13:50
Start date:	14/03/2024
Path:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s
Imagebase:	0x400000
File size:	2'902'256 bytes
MD5 hash:	F6CD94DEAEA55BB414650D6A9CB7DD6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:13:51
Start date:	14/03/2024
Path:	C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe
Wow64 process (32bit):	true
Commandline:	.\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""
Imagebase:	0x400000
File size:	5'299'123 bytes
MD5 hash:	5A3DA2206BD35C381B826FF748093684
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\mia7B89.tmp\TechkonDriver64Bit.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:13:53
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 12FD986294DFC1E2D717A71E276F9E78
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:13:55
Start date:	14/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Imagebase:	0x7ff7d5b50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:13:55
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:13:55
Start date:	14/03/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -f -addstore TrustedPublisher TK1.cer
Imagebase:	0x7ff78ce10000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:13:55
Start date:	14/03/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -f -addstore TrustedPublisher TK2.cer
Imagebase:	0x7ff78ce10000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:13:55
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:13:57
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:13:58
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b34befef-0730-8143-9c9e-bd61c1fc2db9}\dens_x64.inf" "9" "439f12f93" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "c:\progra~1\techko~1\techko~1\dens"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:14:01
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Imagebase:	0x7ff6068e0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:14:01
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9630329f-d9c6-6243-aa02-e362d79d9ca7}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "00000000000000D8" "WinSta0\Default" "0000000000000174" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:14:04
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:14:05
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{8a8e45a5-1c7a-604c-af2d-fe38b7597964}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000198" "WinSta0\Default" "00000000000001A4" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:14:08
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:14:09
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{ae3c78da-2a5f-274d-ae4f-4f019a7a5302}\spectrojet_x64.inf" "9" "4b5792527" "00000000000001A8" "WinSta0\Default" "00000000000001A0" "208" "c:\progra~1\techko~1\techko~1\spectr~4"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:14:14
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:14:15
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{72e5b6f5-f69f-0142-8f2c-556a7103e2ee}\spectrodrive_x64.inf" "9" "40b9ce367" "00000000000001C8" "WinSta0\Default" "00000000000001CC" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:14:21
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:14:26
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{78e370a8-7136-544f-b75e-5eaa32269898}\spectrodrive_x64.inf" "9" "48bc6c0e7" "00000000000001CC" "WinSta0\Default" "0000000000000198" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:14:29
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:14:30
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{47a5f254-7bab-2941-8d2e-a29701fe3f6f}\spectrodens_x64.inf" "9" "46d73562f" "00000000000001E8" "WinSta0\Default" "00000000000001EC" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:14:35
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Imagebase:	0x7ff7081d0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:14:36
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da5ba1e1-0bf2-3b4a-965e-04d24b476102}\spectrojet_x64.inf" "9" "4c691d78b" "00000000000001D4" "WinSta0\Default" "00000000000001D8" "208" "c:\progra~1\techko~1\techko~1\spc171~1"
Imagebase:	0x7ff6b8fc0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	155

Executed Functions

Function 0041F2D0 Relevance: 87.4, APIs: 25, Strings: 24, Instructions: 1660
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041E5C0: GetVersionExW.KERNEL32 ref: 0041E5E0

MessageBoxW.USER32(00000000,022B1500,?,00012010), ref: 0041F322

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

CoInitialize.OLE32(00000000), ref: 0041F350
_memset.LIBCMT ref: 0041F36E
GetVersionExW.KERNEL32 ref: 0041F389
GetCommandLineW.KERNEL32(00000004,00000004,00000004,00000004), ref: 0041F436

Strings

Title, xrefs: 0041FAD0
" /k=", xrefs: 0042075E
D, xrefs: 0042072D
RunProgram, xrefs: 0041FCAF
%%T\, xrefs: 0042061B
%%T, xrefs: 004205E2
, xrefs: 00420358
"/k=, xrefs: 0041F63B
Directory, xrefs: 0041FB7A
", xrefs: 0041F68B
BeginPrompt, xrefs: 0041FAFF
-k=, xrefs: 0041F654
, xrefs: 0041F69A
ExecuteFile, xrefs: 0041FCF6
mia.lib, xrefs: 00420677
/m=", xrefs: 00420775
/k=, xrefs: 0041F666
Progress, xrefs: 0041FB2E
y`, xrefs: 0041F369
<, xrefs: 004202CE
"-k=, xrefs: 0041F620
setup.exe, xrefs: 00420487
@KA, xrefs: 0041FF38
ExecuteParameters, xrefs: 0041FD3D

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Version$CommandErrorFreeHeapInitializeLastLineMessage___sbh_find_block___sbh_free_block__lock_memset
String ID: $ $ /m="$"$" /k="$"-k=$"/k=$%%T$%%T\$-k=$/k=$<$@KA$BeginPrompt$D$Directory$ExecuteFile$ExecuteParameters$Progress$RunProgram$Title$mia.lib$setup.exe$y`
API String ID: 169006075-424830153
Opcode ID: 175f0996da08e8afa2cb0c4591892a040b1c3996568e1093f4379ad1261dcea9
Instruction ID: 8ae80e7e1ea0a5da9484d0cc992cac7dbaeb8ea33a9bedbd46246e47c3c2bf24
Opcode Fuzzy Hash: 175f0996da08e8afa2cb0c4591892a040b1c3996568e1093f4379ad1261dcea9
Instruction Fuzzy Hash: 09D2E6B06143409BD220EB75E842B9FB3E5AFC4308F40892EF58957252DB78F559CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEE0 Relevance: 6.7, APIs: 4, Instructions: 722
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004051E0: __CxxThrowException@8.LIBCMT ref: 00405204
Part of subcall function 004051E0: __CxxThrowException@8.LIBCMT ref: 0040522E
Part of subcall function 004051E0: __CxxThrowException@8.LIBCMT ref: 00405258

_malloc.LIBCMT ref: 0040B193
__CxxThrowException@8.LIBCMT ref: 0040B1AF

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID:
API String ID: 175252994-0
Opcode ID: 37256b94bb60d5af6bc0b7cc110bb3124668dd40debc1630c3715b466050bab0
Instruction ID: a73d485eed2c0f547a0b7567924c6c7deb504bae5797be35f8c618b3fbe3f811
Opcode Fuzzy Hash: 37256b94bb60d5af6bc0b7cc110bb3124668dd40debc1630c3715b466050bab0
Instruction Fuzzy Hash: 49625E71600248DFCB10DF68C880A9EBBF5EF89304F24859EE849AB391C779ED45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0 Relevance: 4.6, APIs: 3, Instructions: 83fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,6210C9B9,?,?), ref: 00407B10
FindFirstFileW.KERNELBASE(?,?,6210C9B9,?,?), ref: 00407B2A
FindFirstFileW.KERNELBASE(?,?), ref: 00407B7E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: e3b150c79052ad27782232c84f3a52fc6a62a57a2177f983f14b6e4624e5d615
Instruction ID: 560bba3c12bb28fd588b29f65aec3029f033ad3fe931a3478cb76b2749ea814c
Opcode Fuzzy Hash: e3b150c79052ad27782232c84f3a52fc6a62a57a2177f983f14b6e4624e5d615
Instruction Fuzzy Hash: E5318F7190C3029FC720DF34D845B5BB7E4EB44724F100B2AE4A5933D1DB38A906CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 3.0, APIs: 2, Instructions: 45comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0041E6A3
CoCreateInstance.OLE32 ref: 0041E6CA

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 2cdb6139d6d9018f19570d7e36b6b22097f60c5826a9e3d961c17cac6fa76371
Instruction ID: 51c3d68f6bde5c068a399ea07d0c0e700ec6cb6b10fcc9f3be2698376900635b
Opcode Fuzzy Hash: 2cdb6139d6d9018f19570d7e36b6b22097f60c5826a9e3d961c17cac6fa76371
Instruction Fuzzy Hash: DC010C74344201AFD310DB96D885F5B77F9AF88B44F50882DF858C72A0E7B8E8498B56

Uniqueness

Uniqueness Score: -1.00%

Function 0041B730 Relevance: 22.7, APIs: 15, Instructions: 227
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041B774
LoadIconW.USER32(00400000,?), ref: 0041B796
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B7A8
SetTimer.USER32(?,00000003,00000064,00000000), ref: 0041B7B7
SetWindowTextW.USER32(?,?), ref: 0041B7C8
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041B7DE
SetDlgItemTextW.USER32(?,000003E7,?), ref: 0041B83D
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B898
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B8AD
SetEvent.KERNEL32 ref: 0041B8BB
GetLastError.KERNEL32 ref: 0041B8C5
GetWindowRect.USER32(?,?), ref: 0041B8F4
GetWindowRect.USER32(?,?), ref: 0041B911
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041B946
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041B9B8

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ErrorEventIconInfoLastLoadMoveParametersPostSystemTimer
String ID:
API String ID: 4208242464-0
Opcode ID: 8212f1b92ac8d9662513c723b768a45af60c9ba66733e5d3f47eddca9276ea67
Instruction ID: 6367b0c4eee05ecfc1dfa8353564df2870d360439f43c4ec88678ed8d53926e9
Opcode Fuzzy Hash: 8212f1b92ac8d9662513c723b768a45af60c9ba66733e5d3f47eddca9276ea67
Instruction Fuzzy Hash: 219145B1608344AFD310DF69C884A5BBBE9EB88704F404A2EF999D7391D774D940CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA60 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041EA8C
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0041EAA3
_memset.LIBCMT ref: 0041EABB
_wcsrchr.LIBCMT ref: 0041EADE
RegCreateKeyExW.KERNELBASE ref: 0041EB1F
RegSetValueExW.KERNELBASE(00000000,IsHostApp,00000000,00000001,00000000,00000002), ref: 0041EB3F
RegCloseKey.ADVAPI32 ref: 0041EB49

Strings

IsHostApp, xrefs: 0041EB34
Applications\, xrefs: 0041EAC0

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: _memset$CloseCreateFileModuleNameValue_wcsrchr
String ID: Applications\$IsHostApp
API String ID: 1474337858-1667566961
Opcode ID: 5cec257a012e9a1e1d57e1157371452729b30d6bfd67cdf483cdb0fb9429fb01
Instruction ID: 4aa4451f33cd243bcb97ec5c147c50c0ddf720af96767f8ac43c9fc97424fe1f
Opcode Fuzzy Hash: 5cec257a012e9a1e1d57e1157371452729b30d6bfd67cdf483cdb0fb9429fb01
Instruction Fuzzy Hash: 7121A7B17943007BE224EB61DC4BFAB73E4AF98B04F40491DB385961C1DAB4A544C79B

Uniqueness

Uniqueness Score: -1.00%

Function 0041D4D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_00006160,?), ref: 0041D4F4
ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D535
DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_00006160,?), ref: 0041D57B
WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D590
SetWindowTextW.USER32(?,?), ref: 0041D5A7
ShowWindow.USER32(?,00000001), ref: 0041D5C0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D5CB

Strings

setup.bmp, xrefs: 0041D50A

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$DialogObjectParamShowSingleWait$CreateText
String ID: setup.bmp
API String ID: 2497262453-2262724209
Opcode ID: 72b3b40019be3ca3750d4009480d7b4b18c2004af0f88731a6715918442dda41
Instruction ID: 1d5dabd48a9213cc4ee5c15c04374f547c5cd17aedaa24753aeb20be2184952a
Opcode Fuzzy Hash: 72b3b40019be3ca3750d4009480d7b4b18c2004af0f88731a6715918442dda41
Instruction Fuzzy Hash: 2A31F175740305ABC720DF25DC41FDB37A8EB48314F500629FA556B281CA34F806CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDD0 Relevance: 12.1, APIs: 8, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00008010), ref: 0041BDE8
GetObjectW.GDI32(00000000,00000018,?), ref: 0041BE15
SendMessageW.USER32(?,00000172,00000000,?), ref: 0041BE2A
MoveWindow.USER32(?,00000000,00000000,?,?,00000001), ref: 0041BE4A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041BE67
GetWindowLongW.USER32(?,000000F0), ref: 0041BECD
AdjustWindowRect.USER32(?,00000000), ref: 0041BED9
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041BEFD

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$Move$AdjustErrorFreeHeapImageInfoLastLoadLongMessageObjectParametersRectSendSystem___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 3689589546-0
Opcode ID: 9d7f9e0890f737e2ba4dd122624acd51a10f9590b6e1cac4c65fd5ed4c9739be
Instruction ID: 03af98d0d0ffadcbe7ba7a864b7898debb76d72cbabd0c032310ea64956284ab
Opcode Fuzzy Hash: 9d7f9e0890f737e2ba4dd122624acd51a10f9590b6e1cac4c65fd5ed4c9739be
Instruction Fuzzy Hash: 8941F8B1604300AFD354CF39DC85F6BBBE9EBC8710F444A2DF98AC6290D671E9458B66

Uniqueness

Uniqueness Score: -1.00%

Function 00421023 Relevance: 12.0, APIs: 8, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 00421029

Part of subcall function 00423265: TlsGetValue.KERNEL32(?,0042102E), ref: 0042326E
Part of subcall function 00423265: __decode_pointer.LIBCMT ref: 00423280
Part of subcall function 00423265: TlsSetValue.KERNEL32(00000000,0042102E), ref: 0042328F

___fls_getvalue@4.LIBCMT ref: 00421034

Part of subcall function 00423245: TlsGetValue.KERNEL32(?,?,00421039,00000000), ref: 00423253

___fls_setvalue@8.LIBCMT ref: 00421047

Part of subcall function 00423299: __decode_pointer.LIBCMT ref: 004232AA

GetLastError.KERNEL32(00000000,?,00000000), ref: 00421050
ExitThread.KERNEL32 ref: 00421057
GetCurrentThreadId.KERNEL32 ref: 0042105D
__freefls@4.LIBCMT ref: 0042107D
__IsNonwritableInCurrentImage.LIBCMT ref: 00421090

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: c00acaf4266d19e5d9d4bfebc160deac36d2b180b2bae20bb46cd11b0c97e720
Instruction ID: ac458970b274fa377b2d346be178e4a5aabec80b7a813b2af96a27a2eaab62bb
Opcode Fuzzy Hash: c00acaf4266d19e5d9d4bfebc160deac36d2b180b2bae20bb46cd11b0c97e720
Instruction Fuzzy Hash: 4101AC70700260EBC714BF62F90990E37B8AF553497A040ABF50587222DB3CD943CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

_malloc.LIBCMT ref: 0041DD10

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 0041DD2A

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

FindCloseChangeNotification.KERNELBASE(00000000,?,00000004,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DFAA
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DFB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DF0D

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 0041D4D0: CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_00006160,?), ref: 0041D4F4
Part of subcall function 0041D4D0: ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D535
Part of subcall function 0041D4D0: DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_00006160,?), ref: 0041D57B
Part of subcall function 0041D4D0: WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D590
Part of subcall function 0041D4D0: SetWindowTextW.USER32(?,?), ref: 0041D5A7
Part of subcall function 0041D4D0: ShowWindow.USER32(?,00000001), ref: 0041D5C0
Part of subcall function 0041D4D0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D5CB

Strings

etup.bmp, xrefs: 0041DE32

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLastWindow$DialogException@8HeapObjectParamShowSingleThrowWait_malloc$AllocateChangeCloseCreateExceptionFindFreeNotificationRaiseText___sbh_find_block___sbh_free_block__lock
String ID: etup.bmp
API String ID: 466410089-3436927654
Opcode ID: 51248fe61525d921019bc7784e8c2f4ce7418bc3d4169d9d94d46c807291a52d
Instruction ID: 14b6864db79aa0758f53e4780a0cfdcd85dd8687eaec00fb5cd2c2bcdf21938c
Opcode Fuzzy Hash: 51248fe61525d921019bc7784e8c2f4ce7418bc3d4169d9d94d46c807291a52d
Instruction Fuzzy Hash: 95D17FB55083808FD320EF65C880B9BB7E5AF98304F14892EF59987351D778E94ACB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB70 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408050: CloseHandle.KERNEL32(?,6210C9B9,00000000,?,80000000,00000001,00000000), ref: 0040807D
Part of subcall function 00408050: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,6210C9B9,00000000,?,80000000,00000001,00000000), ref: 004080B0
Part of subcall function 00408050: CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040810E

CloseHandle.KERNEL32(?,?,00001000,?,80000000,00000001,6210C9B9,?,?,?,00000004,00000000,0042D21B,000000FF,0041F8EB,?), ref: 0041EBF9

Strings

;!@Install@!UTF-8!, xrefs: 0041EC0A, 0041ED33
;!@InstallEnd@!, xrefs: 0041EC22, 0041ECAF

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 3498533004-372238525
Opcode ID: afc51a853e801afb9757ed0c4be47186c9cb9a67f59d5721a3fd60e810a4cbc9
Instruction ID: 951928544ea1403c87551abc08aa41bf64b6ac2c57d2d5833b4dbc2ae828a00e
Opcode Fuzzy Hash: afc51a853e801afb9757ed0c4be47186c9cb9a67f59d5721a3fd60e810a4cbc9
Instruction Fuzzy Hash: AD8109795083818BD330CF26D8847EBBBE1AB55314F540A5EE9D587381D739D8C6CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004210A6 Relevance: 10.6, APIs: 7, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___set_flsgetvalue.LIBCMT ref: 004210D7
__calloc_crt.LIBCMT ref: 004210E3
__getptd.LIBCMT ref: 004210F0
__initptd.LIBCMT ref: 004210F9
CreateThread.KERNELBASE(?,?,00421023,00000000,?,?), ref: 00421127
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00421131
__dosmaperr.LIBCMT ref: 00421149

Part of subcall function 00421D28: __getptd_noexit.LIBCMT ref: 00421D28

Part of subcall function 00423C64: __decode_pointer.LIBCMT ref: 00423C6F

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID:
API String ID: 3358092440-0
Opcode ID: f836f3a5612b81b6d242fef6bf68f0a3a6f628dcc52a2b413912adf7304544da
Instruction ID: e962943f56dbf5af09c7da81f0f6a5c3264a404381241de3fbf0b3df6231d336
Opcode Fuzzy Hash: f836f3a5612b81b6d242fef6bf68f0a3a6f628dcc52a2b413912adf7304544da
Instruction Fuzzy Hash: BA11E672700225EFDB10BFA5FC428AF77A5EF14328B90403FF20597161DB799A518668

Uniqueness

Uniqueness Score: -1.00%

Function 0040A930 Relevance: 9.1, APIs: 6, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A973
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A979
CloseHandle.KERNEL32(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A991
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A997
CloseHandle.KERNEL32(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B1
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B7

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseErrorLast$Handle$ChangeFindNotification
String ID:
API String ID: 499975219-0
Opcode ID: 5ca849f9e80f7cf6a4f2ccd92f1cca5e306e245aee22a54abe53d0d2476e70a3
Instruction ID: b8afac3a52eb0e78b9d4f59a748d0347e24904ef526753f53a3bde94e43bcd0c
Opcode Fuzzy Hash: 5ca849f9e80f7cf6a4f2ccd92f1cca5e306e245aee22a54abe53d0d2476e70a3
Instruction Fuzzy Hash: 3D1181F23087418BD320DF29D800B27B7D8EB90B60F110D3EE89593780D73AE414CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DFE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00420E1C

Part of subcall function 00421F1D: __mtinitlocknum.LIBCMT ref: 00421F33
Part of subcall function 00421F1D: __amsg_exit.LIBCMT ref: 00421F3F
Part of subcall function 00421F1D: EnterCriticalSection.KERNEL32(?,?,?,004234FE,0000000D,00433868,00000008,00421082,?,00000000), ref: 00421F47

___sbh_find_block.LIBCMT ref: 00420E27
___sbh_free_block.LIBCMT ref: 00420E36
RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 7e3986139b8b67c31b0f88678f7bfd5cf2d99dd6cd2fd27712303bc26acdf7ba
Instruction ID: 4a3575ee672623f86528ee1a37db317970acd7e0053c85b255a08892b49a06f0
Opcode Fuzzy Hash: 7e3986139b8b67c31b0f88678f7bfd5cf2d99dd6cd2fd27712303bc26acdf7ba
Instruction Fuzzy Hash: E9018471B04331AADB306FB2BD06B5F7AA09F107A5F91091BF114661E2CB7C8981CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE70 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00407D60: FindNextFileW.KERNELBASE(6210C9B9,?,?,00000000), ref: 00407D8D

FindClose.KERNELBASE(?,?,mia.lib), ref: 0041F146

Strings

mia.lib, xrefs: 0041EE84

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$CloseErrorException@8FileFreeHeapLastNextThrow___sbh_find_block___sbh_free_block__lock_malloc
String ID: mia.lib
API String ID: 2885634111-3926378727
Opcode ID: 106c9770c868863ecd1b176a45e11baaaa2e39fe68dba10e270c5d4592b9eba8
Instruction ID: acefb76dbfd321258123378c1413fdf74a6f6d2c8bb5f67a3714b289b7daedea
Opcode Fuzzy Hash: 106c9770c868863ecd1b176a45e11baaaa2e39fe68dba10e270c5d4592b9eba8
Instruction Fuzzy Hash: A1B18F755083809FC330DB29C44079BB7E1AF85318F444A2EF9D957391D739A98AC79B

Uniqueness

Uniqueness Score: -1.00%

Function 0041CCA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 0041CDBF
FindCloseChangeNotification.KERNELBASE(?), ref: 0041CDD4
GetLastError.KERNEL32 ref: 0041CDE6

Strings

y`, xrefs: 0041CD4B, 0041CD7F

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ChangeCloseErrorFileFindLastNotificationTime
String ID: y`
API String ID: 3673273941-1467889531
Opcode ID: c825ca507cc76167d5b05d5c4b29e77f4d476bc3e0454580608a0aaad5d88e34
Instruction ID: 7b2998dd1cb06f6e771dfa2e92566308564360dd9503c26fc9d92f09fd085f74
Opcode Fuzzy Hash: c825ca507cc76167d5b05d5c4b29e77f4d476bc3e0454580608a0aaad5d88e34
Instruction Fuzzy Hash: 50417E756447418BE330CB79DC84BD3BBE5AB88314F184A2ED19A8B390C779E886C759

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA80 Relevance: 6.5, APIs: 4, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00411B60: _malloc.LIBCMT ref: 00411B86
Part of subcall function 00411B60: __CxxThrowException@8.LIBCMT ref: 00411BA6

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

_malloc.LIBCMT ref: 0040FD1A

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

_malloc.LIBCMT ref: 0040FD5F
__CxxThrowException@8.LIBCMT ref: 004100C7
__CxxThrowException@8.LIBCMT ref: 004100DC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw_malloc$Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 692529005-0
Opcode ID: e6788c5630468db929ac9c789b04f3530ce030de1b07d9ee88f7a53e50e23083
Instruction ID: d51cafb1edd20d86beab4533d3b2c9328e12bc559a924313115bd2a42a8a9446
Opcode Fuzzy Hash: e6788c5630468db929ac9c789b04f3530ce030de1b07d9ee88f7a53e50e23083
Instruction Fuzzy Hash: C732E1B19083809FD330CF6AC480B9BFBE9BF99304F50892EE58987251DB75A549CB57

Uniqueness

Uniqueness Score: -1.00%

Function 00415740 Relevance: 6.4, APIs: 4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfaaab99611489309fe5c89a1719dda8871662554a4d2a74ab80e3c51eccb09
Instruction ID: da1b94ef7b8f146f3bbba7bbd3545de285c411d90d7974845ba9398da385a6a1
Opcode Fuzzy Hash: 8bfaaab99611489309fe5c89a1719dda8871662554a4d2a74ab80e3c51eccb09
Instruction Fuzzy Hash: FC028075604741CFCB10DF29C48069AB7E1FFC5364F148A5EE89A8B346D738E885CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406690 Relevance: 6.1, APIs: 4, Instructions: 83filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,6210C9B9,00000004,?,?,?), ref: 004066D2
CreateFileW.KERNEL32(6210C9B9,40000000,00000003,00000000,00000003,02000000,00000000,?,00000000,00000004), ref: 0040672A
SetFileTime.KERNELBASE(00000000,00000000,00000000,?,?,40000000,00000003,00000000,00000003,02000000,00000000,6210C9B9,00000004,?,?,?), ref: 00406750
FindCloseChangeNotification.KERNELBASE(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,6210C9B9,00000004,?,?,?), ref: 0040675C

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 00407E60: GetCurrentDirectoryW.KERNEL32(00000105,6210C9B9), ref: 00407F53

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: File$Create$ChangeCloseCurrentDirectoryException@8FindNotificationThrowTime_malloc
String ID:
API String ID: 185400808-0
Opcode ID: 4019fdf441a4c4eb5f69e1d984c632c07fca8aefb080f6855eb8301330c79c31
Instruction ID: ac6c79c5a0dc6e211d532a3be32971133362d4db447b27be0444ece16f4d2a22
Opcode Fuzzy Hash: 4019fdf441a4c4eb5f69e1d984c632c07fca8aefb080f6855eb8301330c79c31
Instruction Fuzzy Hash: E02125712443207BE2209F25DC45F5B7BDCEB85B64F50062AF654A72C1C778A905CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 00420FA5 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00420FB8

Part of subcall function 00423830: __FindPESection.LIBCMT ref: 0042388B

__getptd_noexit.LIBCMT ref: 00420FC8
__freeptd.LIBCMT ref: 00420FD2
ExitThread.KERNEL32 ref: 00420FDB

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: 80a01ca7609d5c989842f362529a1f62e76a78053e1eadb625ad7ffcc62f00cd
Instruction ID: e4d375fbbcc4364e754cd5714ee3cf852806fdbcd81a02de693fee1c1a3a24a8
Opcode Fuzzy Hash: 80a01ca7609d5c989842f362529a1f62e76a78053e1eadb625ad7ffcc62f00cd
Instruction Fuzzy Hash: 6CD0C2307412A05ADB203B22FE0E61736A84F04306FD11036F401C45E2CEBCC941C91C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,6210C9B9,?,?,?,?,0042C782,000000FF), ref: 0041D7A6
DestroyWindow.USER32(?,6210C9B9,?,?,?,?,0042C782,000000FF), ref: 0041D7C3

Strings

A, xrefs: 0041D786

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: DestroyWindow
String ID: A
API String ID: 3375834691-2078354741
Opcode ID: 5586f43cb49ad24856759286fed33058e7b89fb5ff18b7701b6384f671d7b546
Instruction ID: 7c98b1cd013b058fd397e9c972b29c14f6c4b2c3c95b67cdc02f0fa2510ff33a
Opcode Fuzzy Hash: 5586f43cb49ad24856759286fed33058e7b89fb5ff18b7701b6384f671d7b546
Instruction Fuzzy Hash: 3931E2B1A04B408BC720DF79C848B87B7E8AF48314F04490EF59987392D779F844CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004083E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00408406
__CxxThrowException@8.LIBCMT ref: 00408429

Strings

out of memory, xrefs: 00408421

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocException@8StringThrow
String ID: out of memory
API String ID: 1617264723-2599737071
Opcode ID: 13725d636b88ff8fd5f4f3596f44767d9b62ef17f027a52fb81a274580c37290
Instruction ID: aec7c54f5a2f0369ed48fcd6afc8c6432b74e5c3ee15c3e0c9f0bed6091b2591
Opcode Fuzzy Hash: 13725d636b88ff8fd5f4f3596f44767d9b62ef17f027a52fb81a274580c37290
Instruction Fuzzy Hash: 44F03074314B4256D7149F2A9A10617F2E4EF98744F60C43EE8C9C3691FF38D841831E

Uniqueness

Uniqueness Score: -1.00%

Function 00408050 Relevance: 4.6, APIs: 3, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,6210C9B9,00000000,?,80000000,00000001,00000000), ref: 0040807D
CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,6210C9B9,00000000,?,80000000,00000001,00000000), ref: 004080B0
CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040810E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 4b125d2712671a8b9b856184b240ac5c30ea288019e4421a8eb221e93ca9e89b
Instruction ID: eaacea67b0cf3e73bad7505eea8c61148c2237cac8ae426234bba4b99fc82f96
Opcode Fuzzy Hash: 4b125d2712671a8b9b856184b240ac5c30ea288019e4421a8eb221e93ca9e89b
Instruction Fuzzy Hash: 44316E716083119BD210DF24CC45B5BBBE8EB84774F104B2DF5A4A72D0D734A905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041C100 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,6210C9B9,?,?,?,?,?,0042BEA8,000000FF,0041C57E,?,?), ref: 0041C12C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042BEA8,000000FF,0041C57E,?,?), ref: 0041C1A7

Strings

y`, xrefs: 0041C140, 0041C171

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: y`
API String ID: 3168844106-1467889531
Opcode ID: 9cbe4fff46b69963bc134ad39493b898461fb08ad28b906b1cb4e27107f027dc
Instruction ID: 256898e5de4089b529f01b85fbd61eb56f82475c3371ccf47f2285002a5edf27
Opcode Fuzzy Hash: 9cbe4fff46b69963bc134ad39493b898461fb08ad28b906b1cb4e27107f027dc
Instruction Fuzzy Hash: 582125B6204B009FC364DF19DA80A6BB3F9FB8C710B514A1EF55A93B10C734B805CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,6210C9B9,?,?,?,?,?,0042BEA8,000000FF,0041C5BF,?,?), ref: 0041C1FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,0042BEA8,000000FF,0041C5BF,?,?), ref: 0041C279

Strings

y`, xrefs: 0041C212, 0041C243

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: y`
API String ID: 3168844106-1467889531
Opcode ID: 8965e7820ab05e143a14055c6ca1c15ace38de8a3e8155362b1ceca85fd9a237
Instruction ID: de78da07c04899c8c77929c97aee399886044714f0d20352497b2a5157ff95ff
Opcode Fuzzy Hash: 8965e7820ab05e143a14055c6ca1c15ace38de8a3e8155362b1ceca85fd9a237
Instruction Fuzzy Hash: 8F2105BA200B009FD350DF59DAC0A6BB3F9FB88710F544A1DF65A93B50C774B8068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406930 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,6210C9B9,?,?,00000000,6210C9B9,?,?,?), ref: 00406965
GetLastError.KERNEL32(?,?), ref: 0040696F
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000004,?,?), ref: 004069B5

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 09fedd525c91c46e77d549ea5cb71cab928228c9b59ed4ab44ca6ba5e70dc188
Instruction ID: 07c36081a8cf2dc79f657bfda38f72f695a10e805b8cff717bcdba199a8b3ed4
Opcode Fuzzy Hash: 09fedd525c91c46e77d549ea5cb71cab928228c9b59ed4ab44ca6ba5e70dc188
Instruction Fuzzy Hash: D611F3B25083149FC210EF259C81A1BB7D8FB85764F410A3EF595A73C1C739E905CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00413890 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 004138CC
GetLastError.KERNEL32 ref: 004138E1

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6c661a8d229cc777c08ed75c1f6bd61d8eaa686054be378eced9a4eb92950332
Instruction ID: d5bed59300834c27db51d3e3e8804af017eb22c56735c72e24745968a0aac8e0
Opcode Fuzzy Hash: 6c661a8d229cc777c08ed75c1f6bd61d8eaa686054be378eced9a4eb92950332
Instruction Fuzzy Hash: CE11E1B661120A8B8310DF2DE8409EB77D8AB85321F10822BFD18C7310D236D95A97F9

Uniqueness

Uniqueness Score: -1.00%

Function 004148C0 Relevance: 3.8, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,6210C9B9,?,?,?,?,?,0042BEA8,000000FF), ref: 004148EE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042BEA8,000000FF), ref: 0041491B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042BEA8,000000FF), ref: 00414954

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 8e528e502c537d0b69e499d11ca13bb5c5ec1de1f9027612ed72021158fe6829
Instruction ID: 625b76eddf601073e9c329e31110d9aa6d4444885a5d27fa199e2bc448fd388d
Opcode Fuzzy Hash: 8e528e502c537d0b69e499d11ca13bb5c5ec1de1f9027612ed72021158fe6829
Instruction Fuzzy Hash: CB1117B6208650AFD300CF59D980F6BB7E8FBC8B20F60452EF615D3350D775A9068BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(00000000,mia,00000000,?,00000000,6210C9B9,00407773,6210C9B9,00000004,6210C9B9,00000000,?,?,00000000,?), ref: 0040766E

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Strings

mia, xrefs: 00407668

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8FileNameTempThrow_malloc
String ID: mia
API String ID: 739282062-834928705
Opcode ID: 91ff85b098e991700fcb46d4f0a7d15549d180b965abfbab977b0fb5837ae3f1
Instruction ID: fab8d13fb08992a67c48349e1e354a0264bd0400b9f99db237117d7352dc61b1
Opcode Fuzzy Hash: 91ff85b098e991700fcb46d4f0a7d15549d180b965abfbab977b0fb5837ae3f1
Instruction Fuzzy Hash: 2AF08971A04A115BE760DB2DC801757B3E5EF94710F258C3BE181E32D0E7F8A8D58B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0F0 Relevance: 3.2, APIs: 2, Instructions: 198COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E17B
__CxxThrowException@8.LIBCMT ref: 0040E199

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID:
API String ID: 3476970888-0
Opcode ID: 40e95080ede214d91f859a98a27c19e464cd825c37e2768df82e68517a21b14b
Instruction ID: ca0a71d6df97ee7a203ef8ceaf52b13062fa548b68773200f7937252f8f4250c
Opcode Fuzzy Hash: 40e95080ede214d91f859a98a27c19e464cd825c37e2768df82e68517a21b14b
Instruction Fuzzy Hash: 9161A2716083048FD724DF29C880B2BB7E5BB89314F040E6EF995A7381D739E8558B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00406F70 Relevance: 3.2, APIs: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00407D60: FindNextFileW.KERNELBASE(6210C9B9,?,?,00000000), ref: 00407D8D

FindClose.KERNELBASE(?), ref: 004070A7
FindClose.KERNEL32(?), ref: 00407130

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$Close$ErrorException@8FileFreeHeapLastNextThrow___sbh_find_block___sbh_free_block__lock_malloc
String ID:
API String ID: 2803430302-0
Opcode ID: 146458d03b0ddfb7acac76936b528f83ff8088b17ca806f1c30c1053e68c23bb
Instruction ID: cc9cac371736834354910bd5cd1b867e14824cd5f17210572d58679627a67666
Opcode Fuzzy Hash: 146458d03b0ddfb7acac76936b528f83ff8088b17ca806f1c30c1053e68c23bb
Instruction Fuzzy Hash: F151A2B15083809BC320DF39D881B5BB7E4BF84314F508A2EF5D997391DA39E8498B57

Uniqueness

Uniqueness Score: -1.00%

Function 00406780 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,6210C9B9,?,?,00000000,0042B6B8,000000FF,004070B9), ref: 004067B0
SetFileAttributesW.KERNEL32(6210C9B9,00000000), ref: 0040680B

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5b3868d93b943efae48f880093a7dcf00f7b0866e36bf908cbcae1e608109585
Instruction ID: 3abfe7707c06ebe879871dbe4fe9751a5188b692b2e6d43a4f0365353a145ddf
Opcode Fuzzy Hash: 5b3868d93b943efae48f880093a7dcf00f7b0866e36bf908cbcae1e608109585
Instruction Fuzzy Hash: C62128B25083118FD310EF24AC01B5BB7D4EB85720F440A2FF955933C0D739A909CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00411960 Relevance: 3.1, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0041198C

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 004119AA

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: ef25ea0bcd1512a68ba3dd87a71a0f8a8ce9e7d625a653c7ad326eb0292e3784
Instruction ID: e2d3d0c5bc6528f75844e64501d0e84db827bd379db6147b3cb7c4b05506265c
Opcode Fuzzy Hash: ef25ea0bcd1512a68ba3dd87a71a0f8a8ce9e7d625a653c7ad326eb0292e3784
Instruction Fuzzy Hash: 09319175208385CFCB14CF15D480A97BBE1EF89314F04896EED999B392D638EA45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAE0 Relevance: 3.1, APIs: 2, Instructions: 75synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041DB58
PostMessageW.USER32(00000001,00008000,00000000,00000000), ref: 0041DB6E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageObjectPostSingleWait
String ID:
API String ID: 1869837590-0
Opcode ID: 627ec1fdba6808bbe801e4296038a541cf8789fabb4638545bf7f397b6626cea
Instruction ID: f70689f1fa0990ff4c806b016051adae220c096d235ed575134d8d770105b2d3
Opcode Fuzzy Hash: 627ec1fdba6808bbe801e4296038a541cf8789fabb4638545bf7f397b6626cea
Instruction Fuzzy Hash: 2B2190B2A08748AFD720CF59D980B9AF7E8FB59324F10426EE55193780C735BD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00406DE0 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406780: SetFileAttributesW.KERNELBASE(?,00000000,6210C9B9,?,?,00000000,0042B6B8,000000FF,004070B9), ref: 004067B0

DeleteFileW.KERNELBASE(?,6210C9B9,?,?,?,00000000,6210C9B9,?,00000000), ref: 00406E1F
DeleteFileW.KERNEL32(?,?,?,00000004,?,?,00000000,6210C9B9,?,00000000), ref: 00406E63

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: File$Delete$Attributes
String ID:
API String ID: 890995776-0
Opcode ID: a4c654311a422871e41f01ebf7195a200fc4afce3709328d9ae48f9f955de1fa
Instruction ID: da23887d15a8d6a19aae8d093848008d0c976a6323084b2f47239b9cdeb27970
Opcode Fuzzy Hash: a4c654311a422871e41f01ebf7195a200fc4afce3709328d9ae48f9f955de1fa
Instruction Fuzzy Hash: 9411D1B25083449BC200EF25DC41A5BB7D8FF85364F410A3EF596673C1D739A80A8BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406870 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?,6210C9B9,00000000,?,?,00000000,000000FF,004070C5,00000000), ref: 004068A2
RemoveDirectoryW.KERNELBASE(?,?,?,00000004,?,00000000,000000FF,004070C5,00000000), ref: 004068E6

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 621f523769aaef9b58c8a91ef20634b5231e089e51fc69d7aa2af418621f3536
Instruction ID: 6976d5837b81d7e19e2d9c0b6484c5b3c993c74492be7e520881c874ba3be3b1
Opcode Fuzzy Hash: 621f523769aaef9b58c8a91ef20634b5231e089e51fc69d7aa2af418621f3536
Instruction Fuzzy Hash: C21103B25083049FD200EF259C81A5BB7D8FB85764F540A3EF595673C1C339A91ACBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00404E60 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00404E79

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: ca639b7b2fc2fd054ff0c6da6038be7c35fdfa58db31256aa2283b9134561a5c
Instruction ID: d774bae47193ae241e059782f28f58bf7092e3c5f54c83e8547326cb30e146d3
Opcode Fuzzy Hash: ca639b7b2fc2fd054ff0c6da6038be7c35fdfa58db31256aa2283b9134561a5c
Instruction Fuzzy Hash: F20171B16107019BC720DF69D402627F3E5AFD8700F50883EE59AC3391EA39F565C756

Uniqueness

Uniqueness Score: -1.00%

Function 004139C0 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 004139EE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00413A18

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: a78a2efdd5613b01d2b79f02f39425878d4e99252d466dafbcb7c97e419e4ac0
Instruction ID: e1ab2209f1384d4f2fa4e66112dcc239a9f12346fb3dde1c493d98484847d039
Opcode Fuzzy Hash: a78a2efdd5613b01d2b79f02f39425878d4e99252d466dafbcb7c97e419e4ac0
Instruction Fuzzy Hash: AC016D752043029FD320CF18D840BA777E8AF84741F40892EE485D7290D3B8DD858BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00413820 Relevance: 3.0, APIs: 2, Instructions: 35fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 0041384D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0041386F

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 6407f021dffc35e2c3c1c4773c865c1866bb2cf9022ef79f00685affb8ef31de
Instruction ID: f641d7c6c31ab4fa61280dfe541440687991b8de954b03818c422660b77a6340
Opcode Fuzzy Hash: 6407f021dffc35e2c3c1c4773c865c1866bb2cf9022ef79f00685affb8ef31de
Instruction Fuzzy Hash: 22F044B56142029BE314DF18C844B6B73E4BB84706F50C92EF889CB290D778DA46DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBE0 Relevance: 3.0, APIs: 2, Instructions: 33timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 0041BBF8
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0041BC2C

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CallbackDispatcherKillTimerUser
String ID:
API String ID: 45433635-0
Opcode ID: d033354e10069cd3944b8f72e8f620b563b4be52a86df29c28ef20a6ecc5271c
Instruction ID: 3a79594e2e4ba89a1939e98a1d4e93963408e146f71aaaaec97657f73b39a7ed
Opcode Fuzzy Hash: d033354e10069cd3944b8f72e8f620b563b4be52a86df29c28ef20a6ecc5271c
Instruction Fuzzy Hash: 46F09A762047009BD324EB19D844FABF7E9EBE4714F00481EF48647280C7B4EC82CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00420FE2 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00420FEE

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

Part of subcall function 00420FA5: __IsNonwritableInCurrentImage.LIBCMT ref: 00420FB8
Part of subcall function 00420FA5: __getptd_noexit.LIBCMT ref: 00420FC8
Part of subcall function 00420FA5: __freeptd.LIBCMT ref: 00420FD2
Part of subcall function 00420FA5: ExitThread.KERNEL32 ref: 00420FDB

__XcptFilter.LIBCMT ref: 0042100F

Part of subcall function 004238EE: __getptd_noexit.LIBCMT ref: 004238F6

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: f435e4da68bb4e7e700f978ae033a954263995bd9a67b8f0c0d73825983e7ee8
Instruction ID: 6b71dbe97c78e0c738289ef996a6cfdb4d609f2d90db79a34b196bfb3e35cf41
Opcode Fuzzy Hash: f435e4da68bb4e7e700f978ae033a954263995bd9a67b8f0c0d73825983e7ee8
Instruction Fuzzy Hash: 59E0E6B1A40614AFD718BFA1D906F3D77759F44716F60405EF1016B2A2CA7D9940DA24

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDA0 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041BDAC
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BDC2

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 2441c42c4b6f22e1cf8c1fee51e8d6bf5436049b2f025d8a7968970b928ded5b
Instruction ID: 60cb442689e21d02718789498e37ea817ec3b23390f51a8d278c0a99377a07cd
Opcode Fuzzy Hash: 2441c42c4b6f22e1cf8c1fee51e8d6bf5436049b2f025d8a7968970b928ded5b
Instruction Fuzzy Hash: 02D0A771780310A7DA344B64FC4AF8273DCAB0CB01F004A5AF24BDB1C0CAB0A4418B18

Uniqueness

Uniqueness Score: -1.00%

Function 00422C80 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00422C88

Part of subcall function 00422C55: GetModuleHandleW.KERNEL32(mscoree.dll,?,00422C8D,?,?,00420F14,000000FF,0000001E,?,00423A5F,?,00000001,?,?,00421EA7,00000018), ref: 00422C5F
Part of subcall function 00422C55: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00422C6F

ExitProcess.KERNEL32 ref: 00422C91

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: fc79cb4a7c75e363490d362e0a29c1fa0792ec12669b4d022235d3ed5050525d
Instruction ID: e8b23ca0be1445246cfa665b12da37794814825febd1767cce8e84558c35c2c0
Opcode Fuzzy Hash: fc79cb4a7c75e363490d362e0a29c1fa0792ec12669b4d022235d3ed5050525d
Instruction Fuzzy Hash: 69B04831100108BBAB112B13ED0A8693E2AEA802A0B904025B809091219AB2A9A3AA88

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00415791,6210C9B9), ref: 00414769
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415791,6210C9B9), ref: 00414797

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0e4be479701c683b50c260801d2e880a7be25350149d4d5141acb3b6feb9e411
Instruction ID: 542480b1d8eb3a287b7ca1102c7a40aaead071fd07a36395327ad36d3e90ae7b
Opcode Fuzzy Hash: 0e4be479701c683b50c260801d2e880a7be25350149d4d5141acb3b6feb9e411
Instruction Fuzzy Hash: 4CF0F631A4072267EB605F26EC857D6A7986B42760F118436F474DB2C0C774D8D28BD4

Uniqueness

Uniqueness Score: -1.00%

Function 004149D0 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,004157F8,6210C9B9), ref: 004149F8
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,004157F8,6210C9B9), ref: 00414A24

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b942ac331d50b9ed078247248d033226dec88fd113c0506c2f77df4ba4ab23b1
Instruction ID: 5a3fa2ac8ef23217d4891ebed1f32e095f862d02ae69871e60c5b41101f2b08d
Opcode Fuzzy Hash: b942ac331d50b9ed078247248d033226dec88fd113c0506c2f77df4ba4ab23b1
Instruction Fuzzy Hash: 59F090B17513235BEB604F39AC057D767D86B45BA0F110136F891DB2C0D77498D28BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407D60 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(6210C9B9,?,?,00000000), ref: 00407D8D

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d6102d2f79556fb804bc3cdef158af67678b0c0b9c80ec8252fa7e3b88ae394d
Instruction ID: db1d632e28ba83ce996c61ce977e882cbc98f0db580175ffcd9fbd943c47ada1
Opcode Fuzzy Hash: d6102d2f79556fb804bc3cdef158af67678b0c0b9c80ec8252fa7e3b88ae394d
Instruction Fuzzy Hash: A4216D706097409FC724DF25D881A6BB7E0BF88304F40896EE59997381D739F90ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0041BADF

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9ff0bd8df8b3e03792c25fa20b94eef2b4d4b427d93619a6059a71ce3b869d11
Instruction ID: 3e7fcfab807292a2e376bda8b89e87e695560b0a2a75ea0193b5ac30183f4faa
Opcode Fuzzy Hash: 9ff0bd8df8b3e03792c25fa20b94eef2b4d4b427d93619a6059a71ce3b869d11
Instruction Fuzzy Hash: 8E017C71704726ABCB14AE65C9C0A9EF795FF84790B44852AE20587A40C77AF890C7EC

Uniqueness

Uniqueness Score: -1.00%

Function 00414B00 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00414B32

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: a8faccb54ebb9ceab76936568196aecc1d1d68a9e48b3df4d26a509061b660e9
Instruction ID: 8c66ba52448962c8d7c79d11f1aabf96f24d692aa692154038ef1fbb5c3a6cbf
Opcode Fuzzy Hash: a8faccb54ebb9ceab76936568196aecc1d1d68a9e48b3df4d26a509061b660e9
Instruction Fuzzy Hash: 3DF03C752042009F8320DB65D851E9BB3E5AFC4751F51C92EE959C7A50E738FC50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004081C0 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,0041EC6D,?,00001000,?,80000000,00000001,6210C9B9,?), ref: 004081FC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7172b6f68366401be356630bd6221e0c059fe72a1489c2c52d4b235dd23c16c7
Instruction ID: 344882e4de680020cf4ff848e1b13181e4dbf44253f8dd695d1efe681d569fc8
Opcode Fuzzy Hash: 7172b6f68366401be356630bd6221e0c059fe72a1489c2c52d4b235dd23c16c7
Instruction Fuzzy Hash: 6FF090722443065BCB54DE89E980B2BF3E8ABE8310F14443FF184DB280DB75A84AC739

Uniqueness

Uniqueness Score: -1.00%

Function 004071B0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNELBASE(?,?,00000105), ref: 004071DC

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8NamePathShortThrow_malloc
String ID:
API String ID: 2966644318-0
Opcode ID: a34fcc026e5eddb0abd216ec2ac06cbd66b9c2a377ebd18c04affc28681fd9f6
Instruction ID: bb03d8354c47a3f1518cb96bd69e0356edef982ec88e3c7f4cbd0e2162754a91
Opcode Fuzzy Hash: a34fcc026e5eddb0abd216ec2ac06cbd66b9c2a377ebd18c04affc28681fd9f6
Instruction Fuzzy Hash: 70F09071A146104AE324CB6CD805957B3E6EF98710F24843EE086EB3C1F6B4A8D28755

Uniqueness

Uniqueness Score: -1.00%

Function 00416430 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1037bae27302ff77d988e6066afcceb1518cd850dd9b0d29756ce5bd2e125e86
Instruction ID: 1e506bf11d9229f6d0cf5c4ad581d819fbbd1b83de968f370b1ea6f3ac2e092d
Opcode Fuzzy Hash: 1037bae27302ff77d988e6066afcceb1518cd850dd9b0d29756ce5bd2e125e86
Instruction Fuzzy Hash: 30F09072108211DAD760DB1DA800FCBB3E09BA0320F02882FF5898A250D239DDD1CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004075E0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?,00000004,00407731,00000004,6210C9B9,00000000,?,?,00000000,?,?,00000000), ref: 00407609

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8FolderPathThrow_malloc
String ID:
API String ID: 2862337592-0
Opcode ID: ce42f76a6e4a08daa65f762c9b60fd1b6d081efab45241d6b49ae351743e7067
Instruction ID: 68fae374c04cf999103e7eb2464c69c75c241746d07472e689ce900bf412340b
Opcode Fuzzy Hash: ce42f76a6e4a08daa65f762c9b60fd1b6d081efab45241d6b49ae351743e7067
Instruction Fuzzy Hash: 84F082306046105BE7749F28EC42BA733E1EB48710F24487AE586DB2D0D6F468C28759

Uniqueness

Uniqueness Score: -1.00%

Function 00407BE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00407AC0: FindClose.KERNEL32(?,6210C9B9,?,?), ref: 00407B10
Part of subcall function 00407AC0: FindFirstFileW.KERNELBASE(?,?,6210C9B9,?,?), ref: 00407B2A
Part of subcall function 00407AC0: FindFirstFileW.KERNELBASE(?,?), ref: 00407B7E

FindClose.KERNEL32(FFFFFFFF,?,6210C9B9,00000000,?,?,0042CDA8,000000FF,004185F5,?), ref: 00407C2E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6c08d5d5c73984ff19fc94b1beb69e089bece98d3ab973c1c2cb81dc39aa8a1f
Instruction ID: 82d1cd481473c7c660dfbb2f871a6913d5477604bf1c6d76b04acfc675b75649
Opcode Fuzzy Hash: 6c08d5d5c73984ff19fc94b1beb69e089bece98d3ab973c1c2cb81dc39aa8a1f
Instruction Fuzzy Hash: 49F012B5648640AFD314CF14C885B5BB7E4EB55730F508B2EF865837D0D738A5058A55

Uniqueness

Uniqueness Score: -1.00%

Function 00416CF0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00416D19

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 58483f906696b6ac3209093b8a20b46d522fc4fe5e9056bc24cbee1589159d37
Instruction ID: 6f280a188e360d4d97a7a4235c3c97e8fe715452bcfdc8feba48839c7927b4f3
Opcode Fuzzy Hash: 58483f906696b6ac3209093b8a20b46d522fc4fe5e9056bc24cbee1589159d37
Instruction Fuzzy Hash: F1E0EDB070070187EB30CA75A841B9373DABF40304F55892ED89EC7219EB38F884C61A

Uniqueness

Uniqueness Score: -1.00%

Function 00421D71 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00421D86

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0cda041672ff756b0c41609eb62c40a4d8100e3eb3300feebbfe4dd53f538022
Instruction ID: 474048e3887c1b198e73afb4c75b232851880925ce40373f535b8a9ed00aa635
Opcode Fuzzy Hash: 0cda041672ff756b0c41609eb62c40a4d8100e3eb3300feebbfe4dd53f538022
Instruction Fuzzy Hash: 92D05E32A60345AEDB105F71BC087727BDC9384395F444436B91DC61D0E674D9518608

Uniqueness

Uniqueness Score: -1.00%

Function 00422E9C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00422EA8

Part of subcall function 00422D70: __lock.LIBCMT ref: 00422D7E
Part of subcall function 00422D70: __decode_pointer.LIBCMT ref: 00422DB5
Part of subcall function 00422D70: __decode_pointer.LIBCMT ref: 00422DCA
Part of subcall function 00422D70: __decode_pointer.LIBCMT ref: 00422DF4
Part of subcall function 00422D70: __decode_pointer.LIBCMT ref: 00422E0A
Part of subcall function 00422D70: __decode_pointer.LIBCMT ref: 00422E17
Part of subcall function 00422D70: __initterm.LIBCMT ref: 00422E46
Part of subcall function 00422D70: __initterm.LIBCMT ref: 00422E56

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 5f6728dbdd02ca0f82008ea286e92dcf27527213ebec36ad61b6cbe6c0ff3923
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 7BB0123268030C33DA212543FC03F063F0D87C1B68FA40061FA0C1D1E2A9E7B96180CD

Uniqueness

Uniqueness Score: -1.00%

Function 00416BD0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00416BDC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 9745679567038125a86f7f9b362c0e0dc38fd11c17bcbc025e12de3b0b86a31c
Instruction ID: b6e4ae063e169a73b64fe1504f4d741089b249f3922f98b11971f443ccffe2ea
Opcode Fuzzy Hash: 9745679567038125a86f7f9b362c0e0dc38fd11c17bcbc025e12de3b0b86a31c
Instruction Fuzzy Hash: 62B012FAB0462152E560F521A881D57B2DC7BB0788B85882BB484D1211F228F4ACC22A

Uniqueness

Uniqueness Score: -1.00%

Function 00415310 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,6210C9B9,?,?,0042B74B,000000FF), ref: 0041534C

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 64b23c1747a59f00b3a7cb71c49a0bb61e7895e5ecc26e207c38e6798bb42fa8
Instruction ID: 45228e7dd2016b5ef2fd0bc3b159d9bd00e66ae215068ebcedc432afdcfb51ae
Opcode Fuzzy Hash: 64b23c1747a59f00b3a7cb71c49a0bb61e7895e5ecc26e207c38e6798bb42fa8
Instruction Fuzzy Hash: 13F0F675604B419BD320CF15C840B57B7E8FB88760F148A29E5A6877E0D779E844CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00415390 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,6210C9B9,?,?,0042B71B,000000FF), ref: 004153CB

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9e23df7032f1c1c763019a4865475cb3fd46ef146c702e0662e34135316dac18
Instruction ID: 20b1c5693166b8bca95178b271d56a26094c7afef8293269c8dfa1a5887baf42
Opcode Fuzzy Hash: 9e23df7032f1c1c763019a4865475cb3fd46ef146c702e0662e34135316dac18
Instruction Fuzzy Hash: 58F01975604B419FD320CF18D840B57B7E8FB88B60F104A29E9A5877D0D779E844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004150E0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00415105

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 91e7c122242a59b9ccdf0bc7cab8ba7e8ce12b952b763bfd60d325ca9c1f4047
Instruction ID: 0420e787cb9a86eed4a7b4d6ef3617ecd3e0c8e4f838007923f70c7bb3aee507
Opcode Fuzzy Hash: 91e7c122242a59b9ccdf0bc7cab8ba7e8ce12b952b763bfd60d325ca9c1f4047
Instruction Fuzzy Hash: FBE0C2B13142016BF3259B748C46FA7339C9B90704F20403FB106CE2C0EBA5D950823D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408DD0 Relevance: 46.8, APIs: 24, Strings: 2, Instructions: 1315COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00408E8A
_malloc.LIBCMT ref: 00408EE9
_malloc.LIBCMT ref: 004090D2
__CxxThrowException@8.LIBCMT ref: 004090EE
__CxxThrowException@8.LIBCMT ref: 00409103
__CxxThrowException@8.LIBCMT ref: 00409118
DeleteCriticalSection.KERNEL32(?,0042FFD8), ref: 00409192
_malloc.LIBCMT ref: 004094E7

Strings

@KA, xrefs: 00408EA3
@KA, xrefs: 00408F00

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: _malloc$Exception@8Throw$CriticalDeleteSection
String ID: @KA$@KA
API String ID: 4184010672-2499244848
Opcode ID: 2173faeb293dca02ee19f3e9e51af43ddb57dbe41030808bd3abe99407723cfe
Instruction ID: 101a39299099d8b7fbc73b7120cb9860c9e9d9b4841921f6e0cd10bc3771a624
Opcode Fuzzy Hash: 2173faeb293dca02ee19f3e9e51af43ddb57dbe41030808bd3abe99407723cfe
Instruction Fuzzy Hash: B0C25A716083818FC320DF69C480B9BBBE4BFC9304F14896EE58997392DB75A945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00405510 Relevance: 24.7, APIs: 16, Instructions: 653COMMON

Download Yara Rule

APIs

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 00405ED0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,?,004055CC,?,00000000), ref: 00405EF6
Part of subcall function 00405ED0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,00000000,?,00000000,?,004055CC,?,00000000), ref: 00405F25

_malloc.LIBCMT ref: 0040563F

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

_malloc.LIBCMT ref: 00405711
_malloc.LIBCMT ref: 004057B0
_malloc.LIBCMT ref: 0040584F
_malloc.LIBCMT ref: 004058EF
_malloc.LIBCMT ref: 0040598F
_malloc.LIBCMT ref: 00405A2D
_malloc.LIBCMT ref: 00405AD2
__CxxThrowException@8.LIBCMT ref: 00405BF8
__CxxThrowException@8.LIBCMT ref: 00405C48
__CxxThrowException@8.LIBCMT ref: 00405C5D
__CxxThrowException@8.LIBCMT ref: 00405C72
__CxxThrowException@8.LIBCMT ref: 00405C87
__CxxThrowException@8.LIBCMT ref: 00405C9C
__CxxThrowException@8.LIBCMT ref: 00405CB1
__CxxThrowException@8.LIBCMT ref: 00405CC6

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw_malloc$ByteCharMultiWide$AllocateHeap
String ID:
API String ID: 3927172719-0
Opcode ID: 46391849c57e93a8729d2033434e9fb67e9fe17df0031d36261b6a635283fe9f
Instruction ID: 94e795bf1a0c9910044c3c2dd5c4af4e6959a853943c1580eb38ed7d93358e0f
Opcode Fuzzy Hash: 46391849c57e93a8729d2033434e9fb67e9fe17df0031d36261b6a635283fe9f
Instruction Fuzzy Hash: FD222871608B908FC7219F39858466BBBD5EF95304F484A2EF8C5A7382D27CE905CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004128A0 Relevance: 11.0, APIs: 7, Instructions: 465synchronizationCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00412B41
__CxxThrowException@8.LIBCMT ref: 00412B58

Part of subcall function 0040A790: _malloc.LIBCMT ref: 0040A7B8
Part of subcall function 0040A790: __CxxThrowException@8.LIBCMT ref: 0040A7D6

__CxxThrowException@8.LIBCMT ref: 00412BD6
__CxxThrowException@8.LIBCMT ref: 00412C3F

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

SetEvent.KERNEL32(?,00000000,?,?,?,?,?,?,?,00433B9C), ref: 00412CDB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 00412CE1
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,00433B9C), ref: 00412D24

Part of subcall function 00415180: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 00415195
Part of subcall function 00415180: GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 0041519E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw$ErrorEventLast$CreateExceptionObjectRaiseSingleWait_malloc
String ID:
API String ID: 2637030848-0
Opcode ID: 4d39b91e3f8c64d9e1cd22e97cb076a47efb473c21de60c66e173e9c86d92202
Instruction ID: 0a967a9db4ba4e0fb76a007f6e616d88927016828e0849af8afb68f1a4c9ab52
Opcode Fuzzy Hash: 4d39b91e3f8c64d9e1cd22e97cb076a47efb473c21de60c66e173e9c86d92202
Instruction Fuzzy Hash: B8028F746047029FC764DF28C580AAAB3E1FF88304F248A1EE595C7351D774F8A6CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00420DEF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00421C9B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00421CB0
UnhandledExceptionFilter.KERNEL32(0042E368), ref: 00421CBB
GetCurrentProcess.KERNEL32(C0000409), ref: 00421CD7
TerminateProcess.KERNEL32(00000000), ref: 00421CDE

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6dce4c989cf31f9a2636c4ce92163af802b09ed08417ef6bccfbb8f4d1c3d290
Instruction ID: e4562c502b537d5cccca84f566efa76d5afb76e5238d3ce5c2676c7199ec694f
Opcode Fuzzy Hash: 6dce4c989cf31f9a2636c4ce92163af802b09ed08417ef6bccfbb8f4d1c3d290
Instruction Fuzzy Hash: 9C21BAB9A04200AFDB10DF6AF8496953BF0BB0C710F80607AEA09873A1E7B45D91CF0D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E440 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E641
__CxxThrowException@8.LIBCMT ref: 0040E784

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Strings

, xrefs: 0040E608

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_malloc
String ID:
API String ID: 1621474382-3916222277
Opcode ID: 48082f854bff1add32f48e4266824b0ab221c14decb41c0ecf9b5038d6d03464
Instruction ID: 4905a2555361d4b40396e2ad8604d136661ad17ace758740d79296136a4cd9e7
Opcode Fuzzy Hash: 48082f854bff1add32f48e4266824b0ab221c14decb41c0ecf9b5038d6d03464
Instruction Fuzzy Hash: B5E191716043018FC714DF2AC48052BB7E5EF89328F548D3FE895A7391DA39E865CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004011C0 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24e76e97f088ff2340df07ce6d8eaf1190ca0a9df6fc331afb225c23a03e0c0
Instruction ID: 6ec0d9b20c51930400a28b2cf4c630a1cacc779d3f08c7b5f658bb3cc2d65df3
Opcode Fuzzy Hash: b24e76e97f088ff2340df07ce6d8eaf1190ca0a9df6fc331afb225c23a03e0c0
Instruction Fuzzy Hash: 74511A31B106204AF30CCF769C842A67BD3DBC9386B44D63DE295DA6D8DABDC017C698

Uniqueness

Uniqueness Score: -1.00%

Function 004011D8 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c170e2161206dc0ced38249dd021522e111bee97a1422566ba6a8047c7c9086
Instruction ID: 8fa4896d0c32512dfa3da576777b2c050686be6e2d8f2528dbc2fa637e1ff780
Opcode Fuzzy Hash: 2c170e2161206dc0ced38249dd021522e111bee97a1422566ba6a8047c7c9086
Instruction Fuzzy Hash: BB510731B106200AF308CF369C842A67BD3DBC9386B44D23DD695DA6E8DABDC017C698

Uniqueness

Uniqueness Score: -1.00%

Function 00424945 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00024903), ref: 0042494A

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 24524984a58f72cb7fe12606cdfcc85d318e1795a0ded427764ce3f430ceae39
Instruction ID: 02c8abee07370e7cb003beee7d17bd52556d1210545f2270e595cfdec49312d0
Opcode Fuzzy Hash: 24524984a58f72cb7fe12606cdfcc85d318e1795a0ded427764ce3f430ceae39
Instruction Fuzzy Hash: F69002B03551154A662017716D4A71A29909AA86027D114716205C415CDAA44052551F

Uniqueness

Uniqueness Score: -1.00%

Function 004102D0 Relevance: .9, Instructions: 901COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f1eac608253b4fa400cd88ccec21fbfb64af6ca787b348a66882f4047c332a
Instruction ID: 01a91eeea2aff737d0b365e6c57a033e2f99f4b8156a15c0193d14d1a608853e
Opcode Fuzzy Hash: 02f1eac608253b4fa400cd88ccec21fbfb64af6ca787b348a66882f4047c332a
Instruction Fuzzy Hash: 1D9228B1508381CFC734DF59C480A9BBBE1BF89304F14892EE59A97351D7B8A885CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040EFF0 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 58cd1e4bd61910ee9209f8ab130cbb053367805de08f4fd01a039497d7822f7e
Instruction ID: e349e95833274217d244d427187e591f8dca3494776eda759b979b6953068a50
Opcode Fuzzy Hash: 58cd1e4bd61910ee9209f8ab130cbb053367805de08f4fd01a039497d7822f7e
Instruction Fuzzy Hash: 0C223774504341DFC724DF15C480A6AB7E1FB88314F14897EE899AB792DB39EC4ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 00403760 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction ID: c2d97246fd2aafeb022947b6bb86a1446f9da4e42c3c7867536164bb694cac53
Opcode Fuzzy Hash: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction Fuzzy Hash: 80024C72A042114BD708CE18C580279BFE6FBC5346F114A3FE496A77C4D778DA88CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040D900 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375dd9bf2b93ec9fd52bb82df78b016270cadd8972f0c5003f6c71272566d0b8
Instruction ID: e10f0c9767169ad6ca306e4759b4dee7f78dd904dd151e380c46861b78301315
Opcode Fuzzy Hash: 375dd9bf2b93ec9fd52bb82df78b016270cadd8972f0c5003f6c71272566d0b8
Instruction Fuzzy Hash: 1CE133B09083808FD764DF68C480B6BBBE1FF89304F51492EE999A7391D774A849CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a52f6b36d15c3f10d6125d052433a857e5dbc77148c06f91a25cd1f24f5737b
Instruction ID: 1e9a4df9b44ad6f4c50e22b14f2fef7b674a283b03798b1cf1174821231ddd43
Opcode Fuzzy Hash: 0a52f6b36d15c3f10d6125d052433a857e5dbc77148c06f91a25cd1f24f5737b
Instruction Fuzzy Hash: 4BD1BD728446A64FE318DF5DDC80235B772EF88310F6A457DC7981B3A2CA34BA21DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00401AB0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e26577fba095136f5744b22ad2f39cb0c53c06d26df2648a4839c972093248a
Instruction ID: a133422d40a656bc7bcaeb9e216c34e50bde69e37971f087a7cef11d5dbccbab
Opcode Fuzzy Hash: 7e26577fba095136f5744b22ad2f39cb0c53c06d26df2648a4839c972093248a
Instruction Fuzzy Hash: 8AD1CC328546A64FE318DF59DC9033577A3EFC8350F2E0279CB950B692CB38A611DB94

Uniqueness

Uniqueness Score: -1.00%

Function 004045A0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction ID: 57494768f0b92b70c1e5fb60671f8c0904b92fa69cceb7a89f96e62002fbccdf
Opcode Fuzzy Hash: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction Fuzzy Hash: 7E61F4112197D29FD311CE3D488026CFFE1EFA71047588B6ED8D287B86C668E56AC7E1

Uniqueness

Uniqueness Score: -1.00%

Function 004042D0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3729e50029bc6c3d4b5788440f5fe005dccf0ff45094f581cd922932bb4b71
Instruction ID: bfe1c4857090628bc31f33145390d4079553c539c8f45b3f89973d2b226e20e8
Opcode Fuzzy Hash: dd3729e50029bc6c3d4b5788440f5fe005dccf0ff45094f581cd922932bb4b71
Instruction Fuzzy Hash: B6613A725087118FC318DF49D48494AF3E1FFC8318F1A8A6DEA885B361D771E959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004013F0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fc0aad63f55b9cb06e14c9a54f79600626f447b6889b17ae8838990c2708ce
Instruction ID: 40e91ebcbfae1216bfcaa19984515f511dc88b32e75e61ccbef25afa7c8177b3
Opcode Fuzzy Hash: 51fc0aad63f55b9cb06e14c9a54f79600626f447b6889b17ae8838990c2708ce
Instruction Fuzzy Hash: FB317F71A0437607E3249E2E8C80126FBE39FD1301F19C27EE69C8B75AD839954A8254

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d56deecd46ef8ef1f69f9754baeca6b831613f74d6383f3ce14ec95c9c5be60
Instruction ID: c5ec1d2ed9afae8cad4480c0fdb6b25e0a32306f29324575231a0c6ad83db5c9
Opcode Fuzzy Hash: 6d56deecd46ef8ef1f69f9754baeca6b831613f74d6383f3ce14ec95c9c5be60
Instruction Fuzzy Hash: 81110A3E370D0607E71C8769AD73AB921C1E384309B88A13DF68BC96D1EE6D9894C20D

Uniqueness

Uniqueness Score: -1.00%

Function 00401100 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction ID: 745e0ab5a1f4135cb869288e75bb92ef0094498d29e0feb23aae1f7a6adb8ed7
Opcode Fuzzy Hash: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction Fuzzy Hash: 0111CE37A54A270BD324A96CDC80B777392EB8A354F1A4271DF449F392D538A94282E8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 95synchronizationwindowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,6210C9B9,?,?,?,?,?,?,0042C340,000000FF), ref: 0041D255
LeaveCriticalSection.KERNEL32(?), ref: 0041D28C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D29E
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041D2A8
PostMessageW.USER32(?,?,?,?), ref: 0041D2C3
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D2CF
CloseHandle.KERNEL32(?), ref: 0041D2D5
EnterCriticalSection.KERNEL32(?), ref: 0041D2EE
LeaveCriticalSection.KERNEL32(?), ref: 0041D317

Strings

y`, xrefs: 0041D25F, 0041D2F8

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait$CloseCreateEventHandleMessagePost
String ID: y`
API String ID: 3292403733-1467889531
Opcode ID: b9247c5f70dafe7bfc19e6b92135a0c60dfd878217866a3eae6bc9666be4be80
Instruction ID: ad018f8797b644248f86de4a6b73993a128294163a90829cbb7abac7b6748e62
Opcode Fuzzy Hash: b9247c5f70dafe7bfc19e6b92135a0c60dfd878217866a3eae6bc9666be4be80
Instruction Fuzzy Hash: FA3117B16047409FD320CB69CC84B67B7E8BB89724F104A1DE5A993790CB74A8068B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406250 Relevance: 16.7, APIs: 11, Instructions: 177windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004062A1
SetForegroundWindow.USER32(00000000), ref: 004062A8
ShowWindow.USER32(?,00000005), ref: 00406324
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040633C
DialogBoxParamW.USER32(00400000,?,?,Function_00006160,?), ref: 00406359
SetEvent.KERNEL32(?), ref: 00406366
ShowWindow.USER32(?,00000005), ref: 00406377
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040638C
MessageBoxW.USER32(?,?,?,?), ref: 004063A2
SetEvent.KERNEL32(?), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$Message$EventPeekShow$DesktopDialogForegroundParam
String ID:
API String ID: 1049595212-0
Opcode ID: b861efee7c899d3e4e1076c67bf2fbbf407496ad3a32fa7bdceb73dce1f1e3b2
Instruction ID: 5797e6bae45bfa39f825304b1f8ed8a4465e7a28c84138b089b3a73a73e676b4
Opcode Fuzzy Hash: b861efee7c899d3e4e1076c67bf2fbbf407496ad3a32fa7bdceb73dce1f1e3b2
Instruction Fuzzy Hash: EA517D763002019FD224DF59E888F6BB3A9EBD8711F11852EF64687391C631EC56CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,6210C9B9,?,?,?,00000000,?,?,0042C7C9,000000FF,0041D69D,?,00000004), ref: 0041D142
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000), ref: 0041D152
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000), ref: 0041D15C

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 004047C0: InitializeCriticalSection.KERNEL32(?,6210C9B9), ref: 004047FE

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9), ref: 0041D1DF
GetLastError.KERNEL32(?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000,0042CB29), ref: 0041D1E8
__CxxThrowException@8.LIBCMT ref: 0041D200

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D14A
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D154

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateEventException@8MessageRegisterThrowWindow$CriticalErrorExceptionInitializeLastRaiseSection_malloc
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 2475960406-1515309323
Opcode ID: 8c3c6d63b363685cc27f5696b87a2b9263a8d1f6cc3ee763bcd4ecdd4307727f
Instruction ID: e389b8cf96f7ef14453b2a34cd2d1995612044cb35cd3128fd44df0df899afb7
Opcode Fuzzy Hash: 8c3c6d63b363685cc27f5696b87a2b9263a8d1f6cc3ee763bcd4ecdd4307727f
Instruction Fuzzy Hash: 173170B1604B86AFD314CF29C881B86FFE8FB19354F54462EE16883641C774B554CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00415210 Relevance: 13.6, APIs: 9, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,6210C9B9,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 00415252
GetLastError.KERNEL32 ref: 0041525C
WaitForSingleObject.KERNEL32(?,000000FF,6210C9B9,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 0041526C
CloseHandle.KERNEL32(?,6210C9B9,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 00415284
GetLastError.KERNEL32 ref: 00415290
CloseHandle.KERNEL32(?,6210C9B9,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 004152AE
GetLastError.KERNEL32 ref: 004152B4
CloseHandle.KERNEL32(?,6210C9B9,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 004152CF
GetLastError.KERNEL32 ref: 004152D5

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast$CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2212007442-0
Opcode ID: 2777ae7e726d2c839fa65e51c23003c870152c2d6633ec8b2ef1ac72c44a5693
Instruction ID: bbc22d7d5e4264d147577bd93a02f4c94613573c8b2e1379b6dd7e4c8a38e6fc
Opcode Fuzzy Hash: 2777ae7e726d2c839fa65e51c23003c870152c2d6633ec8b2ef1ac72c44a5693
Instruction Fuzzy Hash: 0F218FB2304B42CBD720CF25DC44B97B7E8EB94760F144A2AE895C7390D739E845CEA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,6210C9B9), ref: 0041BC7D
LeaveCriticalSection.KERNEL32(?), ref: 0041BC87
EnterCriticalSection.KERNEL32(?), ref: 0041BC95
LeaveCriticalSection.KERNEL32(?), ref: 0041BCC6
MessageBoxW.USER32(?,?,?,00000024), ref: 0041BCF5

Strings

y`, xrefs: 0041BCA3

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Message
String ID: y`
API String ID: 850481049-1467889531
Opcode ID: 97fca20e87f4d19e08f54edf18e8893c9510420802b076d91891b32d89d837be
Instruction ID: 0a8a3c5dcc9595394f3e91466f479760a0ffc0d599377708b9fa38c2404fa1f7
Opcode Fuzzy Hash: 97fca20e87f4d19e08f54edf18e8893c9510420802b076d91891b32d89d837be
Instruction Fuzzy Hash: 6441AFB1204341AFD324DF28D844B6BBBE4FB89714F100619F56A83391C738E946CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041E480 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70memorystringwindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000,00000000,00420153), ref: 0041E4A3
lstrlenW.KERNEL32(00000000), ref: 0041E4B0
LocalAlloc.KERNEL32(00000000,00000040), ref: 0041E4E7
swprintf.LIBCMT ref: 0041E51E
swprintf.LIBCMT ref: 0041E533

Strings

IDispatch error #%d, xrefs: 0041E516
Unknown error 0x%0lX, xrefs: 0041E52B

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: swprintf$AllocFormatLocalMessagelstrlen
String ID: IDispatch error #%d$Unknown error 0x%0lX
API String ID: 1134423501-2934499512
Opcode ID: 027266e23a27e927a6ece381ce4c76f82ce2e5e9c148b84658b8c9045bea832f
Instruction ID: 1d15befb501128dd820a01fae309b8b03904db938a5df1f253dafdad90b1e791
Opcode Fuzzy Hash: 027266e23a27e927a6ece381ce4c76f82ce2e5e9c148b84658b8c9045bea832f
Instruction Fuzzy Hash: 2C21A570200221EBE730EB59ED46FE673A6EF54308F604559F5449B2C2F7B9B982C758

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E9D4
GetModuleFileNameW.KERNEL32(00000000,?,00002000,?,?,?), ref: 0041E9E8
RegCreateKeyExW.ADVAPI32 ref: 0041EA14
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000004,00000000,00000004), ref: 0041EA36
RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,00000004,00000000,00000004), ref: 0041EA40

Strings

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, xrefs: 0041EA02
, xrefs: 0041EA2E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseCreateFileModuleNameValue_memset
String ID: $Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
API String ID: 2280741871-2837994659
Opcode ID: 9ef6a000b2af350e772483fbf86137953c4e018e4428102ed8f1a798441201ee
Instruction ID: 0e3c631b592d9466001b2de6060d7075d7ffc32f5526a3d9b253da112b9fda37
Opcode Fuzzy Hash: 9ef6a000b2af350e772483fbf86137953c4e018e4428102ed8f1a798441201ee
Instruction Fuzzy Hash: 960152B0754300BFF220DB51DC4AF6A77E8EB48B04F80481DF7889A1C2D6B4A405CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2B0 Relevance: 10.7, APIs: 7, Instructions: 156windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0041B2E2
SetWindowTextW.USER32(00000000,?), ref: 0041B2F0

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 00420DFE: __lock.LIBCMT ref: 00420E1C
Part of subcall function 00420DFE: ___sbh_find_block.LIBCMT ref: 00420E27
Part of subcall function 00420DFE: ___sbh_free_block.LIBCMT ref: 00420E36
Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

SetWindowTextW.USER32(?,?), ref: 0041B347
SetDlgItemTextW.USER32(?,000003E8,?), ref: 0041B3A3
SetDlgItemTextW.USER32(?,00000001,?), ref: 0041B3FC
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B455
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B467

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Text$Item$Window$ErrorException@8FreeHeapLastMessageSendThrow___sbh_find_block___sbh_free_block__lock_malloc
String ID:
API String ID: 1891682577-0
Opcode ID: 8616607771760b40af6b41e3cf6a6b38da392e2d415f46127b7d0b13a612a390
Instruction ID: 9124571f9925069902d80d9bec0a2e382c050e0a1f5ab6a584098a3f445e3558
Opcode Fuzzy Hash: 8616607771760b40af6b41e3cf6a6b38da392e2d415f46127b7d0b13a612a390
Instruction Fuzzy Hash: 8C5166B15083809FD700EF69D885B4BBBE8AF88354F40095DF68997292C7B8E545CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0041D5E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Part of subcall function 0041D100: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,6210C9B9,?,?,?,00000000,?,?,0042C7C9,000000FF,0041D69D,?,00000004), ref: 0041D142
Part of subcall function 0041D100: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000), ref: 0041D152
Part of subcall function 0041D100: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000), ref: 0041D15C
Part of subcall function 0041D100: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9), ref: 0041D1DF
Part of subcall function 0041D100: GetLastError.KERNEL32(?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000,0042CB29), ref: 0041D1E8
Part of subcall function 0041D100: __CxxThrowException@8.LIBCMT ref: 0041D200

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000004,00000004,00000004,00000004,6210C9B9,?,?,00000000,00000000,0042CB29,000000FF), ref: 0041D6BD
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG), ref: 0041D6D4
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX), ref: 0041D6E1

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D6C9
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D6D6
A, xrefs: 0041D627

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEvent$Exception@8Throw$ErrorLast_malloc
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG$A
API String ID: 1053270758-1326287800
Opcode ID: e89d548d165c6ccd7a082492aa9f76ceb39d4a342e0e30b07f374673c9fb6d41
Instruction ID: 4717a6013c7829877e93234c158fbe75f12066bf988c191e84262ef118b64ff5
Opcode Fuzzy Hash: e89d548d165c6ccd7a082492aa9f76ceb39d4a342e0e30b07f374673c9fb6d41
Instruction Fuzzy Hash: AA412AF1904B86EFC314CF26C881782FBE4BB58704F508A2EE2A957641C378A558CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00415180 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 00415195
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 0041519E
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 004151BD
ResetEvent.KERNEL32(00000000,?,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 004151D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 004151DD
ResetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00433B9C), ref: 004151E3
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 004151E9

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Event$ErrorLast$CreateReset
String ID:
API String ID: 2684445861-0
Opcode ID: 670938e640ea1e4db209150584b68df53bc7c1080c9c0f0405a21129e5743fbd
Instruction ID: 068eba8924103465b4b96f194371cc6e05a3aa6795ab0b5abca74ce5f4d4681e
Opcode Fuzzy Hash: 670938e640ea1e4db209150584b68df53bc7c1080c9c0f0405a21129e5743fbd
Instruction Fuzzy Hash: E9118431700B01EAE7319B6AEC40BD7B3D89FD4744F60852AE115DA2D4D7B8F8828A2C

Uniqueness

Uniqueness Score: -1.00%

Function 00425E89 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00425E95

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

__amsg_exit.LIBCMT ref: 00425EB5
__lock.LIBCMT ref: 00425EC5
InterlockedDecrement.KERNEL32(?), ref: 00425EE2
InterlockedIncrement.KERNEL32(022B1670), ref: 00425F0D

Strings

(uC, xrefs: 00425EEC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: (uC
API String ID: 4271482742-1954698195
Opcode ID: 53b6455aa11515e4d592943908821254474665f41ed4d2ddcc9aa7fdd670bcc6
Instruction ID: 2ef626678910c1dd51139d3e05b6160cda8dcc3cebfc1a95911fe8bb1d646cc3
Opcode Fuzzy Hash: 53b6455aa11515e4d592943908821254474665f41ed4d2ddcc9aa7fdd670bcc6
Instruction Fuzzy Hash: ED01C271B05A32A7D731AB69B40975A7760BF04711F82401BE40067680CB7C6A418BCD

Uniqueness

Uniqueness Score: -1.00%

Function 00405668 Relevance: 9.3, APIs: 6, Instructions: 345COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405711
_malloc.LIBCMT ref: 004057B0
_malloc.LIBCMT ref: 00405AD2
__CxxThrowException@8.LIBCMT ref: 00405BF8
__CxxThrowException@8.LIBCMT ref: 00405C48
__CxxThrowException@8.LIBCMT ref: 00405C5D
__CxxThrowException@8.LIBCMT ref: 00405C72
__CxxThrowException@8.LIBCMT ref: 00405C87
__CxxThrowException@8.LIBCMT ref: 00405C9C
__CxxThrowException@8.LIBCMT ref: 00405CB1
__CxxThrowException@8.LIBCMT ref: 00405CC6

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID:
API String ID: 175252994-0
Opcode ID: fc412f1c494a58773bb3e593c3a84f722e1a01ff57f4bbf55a0f85afdee95d6c
Instruction ID: 2541870f856653ccb823f565e64bb9a0428d8288f86274e3c318cf1eb10770f2
Opcode Fuzzy Hash: fc412f1c494a58773bb3e593c3a84f722e1a01ff57f4bbf55a0f85afdee95d6c
Instruction Fuzzy Hash: C1B11871608F948BD7215E3D418472BBAD5EB95300F490A7FDCC6AB386D27DE8058F8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB00 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041BB19
LeaveCriticalSection.KERNEL32(?), ref: 0041BB22
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BB42
EnterCriticalSection.KERNEL32(?), ref: 0041BB4F
LeaveCriticalSection.KERNEL32(?), ref: 0041BB72
__aulldiv.LIBCMT ref: 0041BBBC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$MessagePost__aulldiv
String ID:
API String ID: 3743465594-0
Opcode ID: e829717b7742392a5d7cac33a0f9957d49dedec6ac4da5b3686c1d9b361c6041
Instruction ID: d581ea35383060334206f5fcdd51a0bd68e0bee2ddb56b36f4aad4860aba5ccc
Opcode Fuzzy Hash: e829717b7742392a5d7cac33a0f9957d49dedec6ac4da5b3686c1d9b361c6041
Instruction Fuzzy Hash: 68219C71244704ABD220EF759C80B6BF7E8EF55B04F04081EF69643B41CB75B84687A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF80 Relevance: 9.1, APIs: 6, Instructions: 56synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF99
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041BFBB
SendMessageW.USER32(00000000,?,00000000,?), ref: 0041BFD3
CloseHandle.KERNEL32(?), ref: 0041BFDD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BFE9
MessageBoxW.USER32(00000000,?,?,?), ref: 0041C00C

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageObjectSingleWait$CloseCreateEventHandleSend
String ID:
API String ID: 3833482109-0
Opcode ID: 0b788cf7af48f74d30c4f0ea5c33d9a8adc3578a1e0daadd6c1318ae98fe1c94
Instruction ID: f91b4b6455c39529ea0f93616aee9c7d89bd0d9653428511fc5c91251fe49f37
Opcode Fuzzy Hash: 0b788cf7af48f74d30c4f0ea5c33d9a8adc3578a1e0daadd6c1318ae98fe1c94
Instruction Fuzzy Hash: 42110475604301AFD224DF19DC85F5BB7E8EB88B10F108A1DF59693290D670E80ACBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0042A798 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0042A7C0

Part of subcall function 0042A250: __getptd.LIBCMT ref: 0042A25E
Part of subcall function 0042A250: __getptd.LIBCMT ref: 0042A26C

__getptd.LIBCMT ref: 0042A7CA

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

__getptd.LIBCMT ref: 0042A7D8
__getptd.LIBCMT ref: 0042A7E6
__getptd.LIBCMT ref: 0042A7F1
_CallCatchBlock2.LIBCMT ref: 0042A817

Part of subcall function 0042A2F5: __CallSettingFrame@12.LIBCMT ref: 0042A341

Part of subcall function 0042A8BE: __getptd.LIBCMT ref: 0042A8CD
Part of subcall function 0042A8BE: __getptd.LIBCMT ref: 0042A8DB

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: c7e7ad533ae3627070de73a8c96b375c480b9e549fa1ae8810a74d308af93d28
Instruction ID: 3cc8a83238399075c8bf7f55cda3e9e413e54d6c728d6c92a07a975ed0d10dd3
Opcode Fuzzy Hash: c7e7ad533ae3627070de73a8c96b375c480b9e549fa1ae8810a74d308af93d28
Instruction Fuzzy Hash: A1113771E00219EFDB00EFA5E446BAD7BB0FF08319F5080AAF814A7251DB7C8A119F58

Uniqueness

Uniqueness Score: -1.00%

Function 0041CF30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,6210C9B9,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF6A
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF7E
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF88

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041CF76
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041CF80

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEventException@8Throw_malloc
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 1188034692-1515309323
Opcode ID: 7fa1a575ea346de8f28e5e3722ceb1a3217c4de9ee22338078f5ffbbcd47b5eb
Instruction ID: e1c83e00d976b7b479650104844ec0f6e79c37c59f4d0df13700cc8b20bf3eca
Opcode Fuzzy Hash: 7fa1a575ea346de8f28e5e3722ceb1a3217c4de9ee22338078f5ffbbcd47b5eb
Instruction Fuzzy Hash: 58118BB1A04746AFD300CF26C880B12FBE8FB48760F504A2FE55893A80C378B814CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6C0 Relevance: 8.8, APIs: 7, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0041C5A8), ref: 0041B6CE
LeaveCriticalSection.KERNEL32(?,?,?,?,0041C5A8), ref: 0041B6DE
EnterCriticalSection.KERNEL32(?), ref: 0041B6E8
LeaveCriticalSection.KERNEL32(?), ref: 0041B6F2
Sleep.KERNEL32(00000064), ref: 0041B6FD
EnterCriticalSection.KERNEL32(?), ref: 0041B704
LeaveCriticalSection.KERNEL32(?), ref: 0041B70E

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Sleep
String ID:
API String ID: 2348874005-0
Opcode ID: f8c0275f32117be734c0b8a6040b515ae9982e18d29e130f81fb3d05d829968e
Instruction ID: 7d0ab2ec63e2e510b595603aed5c06e49eb38fb67e82f02a5ca42a647926e9c3
Opcode Fuzzy Hash: f8c0275f32117be734c0b8a6040b515ae9982e18d29e130f81fb3d05d829968e
Instruction Fuzzy Hash: 4FF0F96210E3E17DE31197B99C80BEBFFC8AF4A114F48044AF38542642CB64E499D3EE

Uniqueness

Uniqueness Score: -1.00%

Function 00425BED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00425BF9

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

__getptd.LIBCMT ref: 00425C10
__amsg_exit.LIBCMT ref: 00425C1E
__lock.LIBCMT ref: 00425C2E

Strings

@tC, xrefs: 00425C3B

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @tC
API String ID: 3521780317-727578634
Opcode ID: 145753e285c5e819699dd0d52c40f939310fd69faf0bf32d7e85385b5de77921
Instruction ID: 30e58af24ec6dc2494b6d2a1ee9744a6ddf721026bf7940203965d5c325c8976
Opcode Fuzzy Hash: 145753e285c5e819699dd0d52c40f939310fd69faf0bf32d7e85385b5de77921
Instruction Fuzzy Hash: EEF0F632F04B309BC730BB76B80274D72A06F00768F80855FE450AB2D1DF7C99419A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042A4E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042A501

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

__getptd.LIBCMT ref: 0042A512
__getptd.LIBCMT ref: 0042A520

Strings

csm, xrefs: 0042A4FA
MOC, xrefs: 0042A4F3

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 4d840f31e8c3b6747dcaf74e30ba91531bc5c6d2a8011580871252e01c7f1ca9
Instruction ID: b5e6c7ade125d5cab53eb7e1327d900a84a9449078cb73c0769f20bf7913c8cb
Opcode Fuzzy Hash: 4d840f31e8c3b6747dcaf74e30ba91531bc5c6d2a8011580871252e01c7f1ca9
Instruction Fuzzy Hash: D0E04F76B001289FD710AF65E446B2A33A4EB5435DF9940E7E80DC7323CB3CDA90995B

Uniqueness

Uniqueness Score: -1.00%

Function 00412680 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00412E00: _malloc.LIBCMT ref: 00412E03
Part of subcall function 00412E00: __CxxThrowException@8.LIBCMT ref: 00412E21

Part of subcall function 0040A930: FindCloseChangeNotification.KERNELBASE(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A973
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A979
Part of subcall function 0040A930: CloseHandle.KERNEL32(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A991
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A997
Part of subcall function 0040A930: CloseHandle.KERNEL32(?,6210C9B9,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B1
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B7

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000), ref: 0041271E
GetLastError.KERNEL32 ref: 0041272A
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412740
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412752
GetLastError.KERNEL32 ref: 0041275F

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast$CloseCreateEvent$Handle$ChangeException@8FindNotificationThrow_malloc
String ID:
API String ID: 3827169974-0
Opcode ID: 516182abb57a05b54fca2bc3085f438cd3bdaa9ed7492599c5cdafcbb9abd9f7
Instruction ID: 8ace0b9d7f818b423eaf7a3375f85a0c12461cedc0be4e9cb63852f0f41e943e
Opcode Fuzzy Hash: 516182abb57a05b54fca2bc3085f438cd3bdaa9ed7492599c5cdafcbb9abd9f7
Instruction Fuzzy Hash: DA317A716083009FC720DF1AD984E5BBBF5EBD8710F104A2EF955C7290D7B5A881CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 00414F10 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00414F26
GetLastError.KERNEL32 ref: 00414F36
SetEvent.KERNEL32(?), ref: 00414F3C
GetLastError.KERNEL32 ref: 00414F46
WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FF), ref: 00414F60

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorEventLast$MultipleObjectsResetWait
String ID:
API String ID: 234195192-0
Opcode ID: c0e4b5393c150b2b1d41074350501775be6a1a9ae23a0de58fb55b33defacd65
Instruction ID: 8f6e04e233e7f0ecea5ba5d329dc9ff630179ca758a6f2b2f67ed5664254b869
Opcode Fuzzy Hash: c0e4b5393c150b2b1d41074350501775be6a1a9ae23a0de58fb55b33defacd65
Instruction Fuzzy Hash: DA017C752003018BD320DF69DC80A67B7E4FBD8711F40892EE994C7390EB75E94ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF20 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF30
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041BF3A
PostMessageW.USER32(?,?,?,?), ref: 0041BF55
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF61
CloseHandle.KERNEL32(?), ref: 0041BF67

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventHandleMessagePost
String ID:
API String ID: 1259710111-0
Opcode ID: 806b293743ddfa5fc6b1ad8d583cf7613af39d7d78647ed7c97bbd4295f491a7
Instruction ID: ea334cb5308d7a0064a28a168c68656027542afff3d651ce4ab8b114c3d9b8ee
Opcode Fuzzy Hash: 806b293743ddfa5fc6b1ad8d583cf7613af39d7d78647ed7c97bbd4295f491a7
Instruction Fuzzy Hash: 25F0F475204710ABC230DB59EC44F57B7F8EB88B20F108A19B6A6936D0CAB0F8068B65

Uniqueness

Uniqueness Score: -1.00%

Function 00421017 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00422EB2: _doexit.LIBCMT ref: 00422EBE

___set_flsgetvalue.LIBCMT ref: 00421029

Part of subcall function 00423265: TlsGetValue.KERNEL32(?,0042102E), ref: 0042326E
Part of subcall function 00423265: __decode_pointer.LIBCMT ref: 00423280
Part of subcall function 00423265: TlsSetValue.KERNEL32(00000000,0042102E), ref: 0042328F

___fls_getvalue@4.LIBCMT ref: 00421034

Part of subcall function 00423245: TlsGetValue.KERNEL32(?,?,00421039,00000000), ref: 00423253

___fls_setvalue@8.LIBCMT ref: 00421047

Part of subcall function 00423299: __decode_pointer.LIBCMT ref: 004232AA

GetLastError.KERNEL32(00000000,?,00000000), ref: 00421050
ExitThread.KERNEL32 ref: 00421057
GetCurrentThreadId.KERNEL32 ref: 0042105D
__freefls@4.LIBCMT ref: 0042107D
__IsNonwritableInCurrentImage.LIBCMT ref: 00421090

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: bc891c8cc3a9ed2b47b42c33089eae5230942977b4943d2a676965e3f78bf5e9
Instruction ID: 83bb7702ffc322df95131e4f038506dbf831791f9a049fe5e58ed36b667dd280
Opcode Fuzzy Hash: bc891c8cc3a9ed2b47b42c33089eae5230942977b4943d2a676965e3f78bf5e9
Instruction Fuzzy Hash: 53E01A61A00265B78A103FB3A80A99F363C9E52749BD00096BA10A3526DA7D9A5246BE

Uniqueness

Uniqueness Score: -1.00%

Function 00426F6A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00426F8C
__calloc_crt.LIBCMT ref: 00426FA5

Strings

`zC, xrefs: 00426FDE
PzC, xrefs: 00426FBC

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __calloc_crt
String ID: PzC$`zC
API String ID: 3494438863-1456556264
Opcode ID: 32c63129b1e8f2c28b3341d94d13e4b0a4d7567ff4f6f6cd765ea066401786c0
Instruction ID: dd3374fb07d57d5fef9b73be00fb61b026adc5eecfbbd3b9a5eabc426370d495
Opcode Fuzzy Hash: 32c63129b1e8f2c28b3341d94d13e4b0a4d7567ff4f6f6cd765ea066401786c0
Instruction Fuzzy Hash: 2B11067170832157EF248A2EBD406662795EB89738BA6523BF512DB3D0E738C841564C

Uniqueness

Uniqueness Score: -1.00%

Function 0042AB45 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0042AB58

Part of subcall function 0042AAB3: ___BuildCatchObjectHelper.LIBCMT ref: 0042AAE9

_UnwindNestedFrames.LIBCMT ref: 0042AB6F
___FrameUnwindToState.LIBCMT ref: 0042AB7D

Strings

csm, xrefs: 0042AB54, 0042AB69, 0042AB7C, 0042AB9A, 0042ABAA

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
Instruction ID: 352b65d85e3f361666db549a6aa94732db8901d912654677eb1acc1d955f8a35
Opcode Fuzzy Hash: a1cdc47254b0d1e876ebf16cdfd679722edd35116a1de451e27b255c7f3a5f87
Instruction Fuzzy Hash: FA016D31600129BBCF126F52ED45EEB7F6AEF08344F844016FD1815121D73AE9B1DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00425BAF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 00425BC1

Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425A99
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425AA6
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425AB3
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425AC0
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425ACD
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425AE9
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(00000000), ref: 00425AF9
Part of subcall function 00425A87: InterlockedIncrement.KERNEL32(?), ref: 00425B0F

___removelocaleref.LIBCMT ref: 00425BCC

Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B30
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B3D
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B4A
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B57
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B64
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425B80
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(00000000), ref: 00425B90
Part of subcall function 00425B16: InterlockedDecrement.KERNEL32(?), ref: 00425BA6

___freetlocinfo.LIBCMT ref: 00425BE0

Part of subcall function 0042593E: ___free_lconv_mon.LIBCMT ref: 00425984
Part of subcall function 0042593E: ___free_lconv_num.LIBCMT ref: 004259A5
Part of subcall function 0042593E: ___free_lc_time.LIBCMT ref: 00425A2A

Strings

@tC, xrefs: 00425BD7

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @tC
API String ID: 467427115-727578634
Opcode ID: 848e212ff2aad06d733f0349b9acfcde226f86cbb15630d170823ae0e6abffb7
Instruction ID: b5ba1389b25c91b46fd07a028c6ca5296a478f30e276532976cf798ea397e946
Opcode Fuzzy Hash: 848e212ff2aad06d733f0349b9acfcde226f86cbb15630d170823ae0e6abffb7
Instruction Fuzzy Hash: 87E04F72B0DC31568A312D297400A6B9A980F92729BED015BF854AF255DB3C7C80C1AD

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6E0 Relevance: 6.5, APIs: 2, Strings: 2, Instructions: 461COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041C702
LeaveCriticalSection.KERNEL32(?), ref: 0041C713

Strings

y`, xrefs: 0041CAAE, 0041CBC0
@N@, xrefs: 0041C983

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @N@$y`
API String ID: 3168844106-1306932553
Opcode ID: 8acf8df9a3d0fdefd6065d42bdf7b300d5136280e86f815acb5728404d03b38b
Instruction ID: 7b22e8e9bfa59ed91af09dfebfb28f908978085d459430ebb598829989cac8c5
Opcode Fuzzy Hash: 8acf8df9a3d0fdefd6065d42bdf7b300d5136280e86f815acb5728404d03b38b
Instruction Fuzzy Hash: 5C02AE716143009BC714EF65D880A9BB3E5BFC8304F40492EF9899B391DB78ED49CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004272E8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042731C
__isleadbyte_l.LIBCMT ref: 00427350
MultiByteToWideChar.KERNEL32(00000080,00000009,0042483B,?,00000000,00000000,?,?,?,?,0042483B,00000000,?), ref: 00427381
MultiByteToWideChar.KERNEL32(00000080,00000009,0042483B,00000001,00000000,00000000,?,?,?,?,0042483B,00000000,?), ref: 004273EF

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 503fc64783cdc75aa604b72b50f3a0e1d00f111cbe2dfcd2591cf5f7725bb183
Instruction ID: 30f3a3cf3d7bded6c2365c7307b84cf2c415d4f83ec559ad1e5e2fe5da1fc46e
Opcode Fuzzy Hash: 503fc64783cdc75aa604b72b50f3a0e1d00f111cbe2dfcd2591cf5f7725bb183
Instruction Fuzzy Hash: B131F331B08266EFDB20DF64E8809AF3BA0BF01310F94496AEC519B291D734DD41EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414DD0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414DF5

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 00414E13

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

_malloc.LIBCMT ref: 00414E3C
__CxxThrowException@8.LIBCMT ref: 00414E58

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateExceptionHeapRaise
String ID:
API String ID: 82271797-0
Opcode ID: 1b4761a27853a6d515ded4f4d5083617d20ee02b90ed2da3791ae6e4941ba561
Instruction ID: 2ffd3e263cceee234fdb73287dd7cd2a62e354bdd83d4882af6582ef0a5dfc93
Opcode Fuzzy Hash: 1b4761a27853a6d515ded4f4d5083617d20ee02b90ed2da3791ae6e4941ba561
Instruction Fuzzy Hash: DF218EB1604751DFC310DF1AC481A4AFBE4FF8C714F508A6EE9A997340D339A945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004086A0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 004086B5
GetLastError.KERNEL32 ref: 004086C1
GetWindowTextW.USER32(?,?,00000001), ref: 004086EB
GetLastError.KERNEL32 ref: 00408717

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLastTextWindow$Length
String ID:
API String ID: 3440162706-0
Opcode ID: c0ddd3581b0e531c08e679f2064eb4f7fc4116aa240d8e2fe6827b0531aec1fd
Instruction ID: 07fccb4b5a50a5a39ac797d7d7c016af7ded2db5039dfe4e2d7ff4f9233aebd5
Opcode Fuzzy Hash: c0ddd3581b0e531c08e679f2064eb4f7fc4116aa240d8e2fe6827b0531aec1fd
Instruction Fuzzy Hash: 6B11A1752145128BD724DF79E94491B73E5EFD4310711457EE086C7394EB35D8428BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415120 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415132
SetEvent.KERNEL32(?), ref: 00415154
GetLastError.KERNEL32 ref: 0041515A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415162

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ObjectSingleWait$ErrorEventLast
String ID:
API String ID: 3117263442-0
Opcode ID: 58b0573d5ea3f526ce09629d59f4af3ae64b585e59b04b0ade2fd1c9e074ec63
Instruction ID: feaf804519cf69de200bc99c0c312eed2e15eb9b6703e4fc041637bf795a50c3
Opcode Fuzzy Hash: 58b0573d5ea3f526ce09629d59f4af3ae64b585e59b04b0ade2fd1c9e074ec63
Instruction Fuzzy Hash: E3F0B476604715AFD721DF69DC40AA7B3E8BB89330B104B29E1A183390CB74FC828768

Uniqueness

Uniqueness Score: -1.00%

Function 00412850 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 0041286D
GetLastError.KERNEL32 ref: 00412873
ResetEvent.KERNEL32(?), ref: 0041287D
GetLastError.KERNEL32 ref: 00412883

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorEventLastReset
String ID:
API String ID: 1621066496-0
Opcode ID: fb3bcf7261792f35598a1087b45479a14e7556373594df7cd1b80a5989da819f
Instruction ID: 8222d6231367c2f95b5b8b75f07a3969ecdbb72d7db14b241ba787fa5bd73eff
Opcode Fuzzy Hash: fb3bcf7261792f35598a1087b45479a14e7556373594df7cd1b80a5989da819f
Instruction Fuzzy Hash: A9F05E76600315CF8730AFAADD80457B7E8EF88651301497AD945CB211D7B1E9929BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00427BE8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00427EA1

Strings

@, xrefs: 00427BEE
@, xrefs: 00427E09

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __aulldvrm
String ID: @$@
API String ID: 1302938615-149943524
Opcode ID: 5adcdd753ec2b723029b06486653012a5a54ee49c1a7e7cef00a8d7ede8f7d62
Instruction ID: f2cc8ee446808ae59cef878a6a88defbe21501969489561079c956f54066fcd4
Opcode Fuzzy Hash: 5adcdd753ec2b723029b06486653012a5a54ee49c1a7e7cef00a8d7ede8f7d62
Instruction Fuzzy Hash: D52193F0B082388BDB248A15DD843AAB7B1AB50304F5584EED749A7241D7784EC68F6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040BD52

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 0040BD6E

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Strings

@KA, xrefs: 0040BD76

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: @KA
API String ID: 2732643326-2643309338
Opcode ID: c643aa32da839dd5923294ee2737ce9db97ee4e9dfd504c2a1349e5d4e27d444
Instruction ID: c9530b6c2466bd8b8310afa81e3857d106ad429d7d1c9ee626c047d2608ca099
Opcode Fuzzy Hash: c643aa32da839dd5923294ee2737ce9db97ee4e9dfd504c2a1349e5d4e27d444
Instruction Fuzzy Hash: B4214AB1604B01AFC314CF1AD880A06FBE8FF48710F508A2EE15997740D379A945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E60: _malloc.LIBCMT ref: 00404E79
Part of subcall function 00404E60: __CxxThrowException@8.LIBCMT ref: 00404E97

FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,00000004,6210C9B9,00000000,?, /m="), ref: 0041AEF0
LocalFree.KERNEL32(?), ref: 0041AF0A

Strings

/m=", xrefs: 0041AE9F

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Exception@8FormatFreeLocalMessageThrow_malloc
String ID: /m="
API String ID: 2713084418-3487320
Opcode ID: 695fc31bdaacbd9ee0ee099f19c2e04b9b79b9a2f59bf99be6fb8de6d3772c06
Instruction ID: 0f6c590e0b8d9d0c3bb6e6ee73bddb7d9bdabd2836573f11952a495bd2579edb
Opcode Fuzzy Hash: 695fc31bdaacbd9ee0ee099f19c2e04b9b79b9a2f59bf99be6fb8de6d3772c06
Instruction Fuzzy Hash: A11148B2208340AFD210CF0AD944F5BFBE8EBC8B50F004A2EF18593290C374A805CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00417A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00417A2A

Part of subcall function 00420EDB: __FF_MSGBANNER.LIBCMT ref: 00420EFE
Part of subcall function 00420EDB: __NMSG_WRITE.LIBCMT ref: 00420F05
Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

__CxxThrowException@8.LIBCMT ref: 00417A48

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Strings

P!@, xrefs: 00417A4D

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: P!@
API String ID: 2732643326-1774101457
Opcode ID: b074ee54cf392ed619f1c446642dba3e17fe1378a77f7c51f056ead93905ddcd
Instruction ID: 93b110ce856f9f77dc8d651a0d17805c1ef403e66c2c9fa0dc688d9785415849
Opcode Fuzzy Hash: b074ee54cf392ed619f1c446642dba3e17fe1378a77f7c51f056ead93905ddcd
Instruction Fuzzy Hash: 1D01B5726017009FC324CF69D844A57B7E4EF49750B04DA1FE46687791D778E901CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042A8BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042A2A3: __getptd.LIBCMT ref: 0042A2A9
Part of subcall function 0042A2A3: __getptd.LIBCMT ref: 0042A2B9

__getptd.LIBCMT ref: 0042A8CD

Part of subcall function 00423453: __getptd_noexit.LIBCMT ref: 00423456
Part of subcall function 00423453: __amsg_exit.LIBCMT ref: 00423463

__getptd.LIBCMT ref: 0042A8DB

Strings

csm, xrefs: 0042A8E9

Memory Dump Source

Source File: 00000000.00000002.2622172604.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2622119041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622209940.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622243943.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622295767.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 26f5b4ee94be2f9113aeb72c9edffe32651a80864b1a22db6be04ae8b8d7f983
Instruction ID: 8c5aa1a117a409ff434ae2770331204e203b5b6a1d8a62d67ab1246687778dcf
Opcode Fuzzy Hash: 26f5b4ee94be2f9113aeb72c9edffe32651a80864b1a22db6be04ae8b8d7f983
Instruction Fuzzy Hash: A4018F74A012248BCF349F26F44076FB3B4AF60315F95489FE88256361CB388AE1CB5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TDService.exePID: 3624, Parent PID: 5244COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.9%
Total number of Nodes:	992
Total number of Limit Nodes:	20

Executed Functions

Function 6CC5AE70 Relevance: 22.4, APIs: 2, Strings: 10, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 6CC607D0: CharUpperW.USER32(?,00000000,?,6CC5FCF3,?,6CC5FE6C,?,00000000,?,00000010,B4419C60,?,00000000,00000000), ref: 6CC607F7
Part of subcall function 6CC607D0: CharUpperW.USER32(?,?,6CC5FE6C,?,00000000,?,00000010,B4419C60,?,00000000,00000000), ref: 6CC60804

_memset.LIBCMT ref: 6CC5B3D4
VariantClear.OLEAUT32(?), ref: 6CC5BEEE

Strings

rar, xrefs: 6CC5B8F8
iso, xrefs: 6CC5B996
udf, xrefs: 6CC5BA33
exe, xrefs: 6CC5B192
001, xrefs: 6CC5B76A
R, xrefs: 6CC5B891
r, xrefs: 6CC5B899
Unknown error, xrefs: 6CC5BEB2, 6CC5BEB7
a, xrefs: 6CC5B895
!, xrefs: 6CC5B89D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CharUpper$ClearVariant_memset
String ID: !$001$R$Unknown error$a$exe$iso$r$rar$udf
API String ID: 2702283269-2136912355
Opcode ID: 6c2dcc235a526218a064a9219a22b03a65bbd1dc26e4a410ab0a5e7f03907a09
Instruction ID: 9c56bac5e93b5c17ce738ca691599a03b830d5fbaaab75a8b7d5575671ec3ce4
Opcode Fuzzy Hash: 6c2dcc235a526218a064a9219a22b03a65bbd1dc26e4a410ab0a5e7f03907a09
Instruction Fuzzy Hash: CBC27B759012688FCB24CF28CC90BDABBB0BF49304F5441D9E549AB750EB71AEA5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CC58AB0 Relevance: 16.8, APIs: 7, Strings: 2, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6CC58BF9
_malloc.LIBCMT ref: 6CC58CB0
__CxxThrowException@8.LIBCMT ref: 6CC58CCA
__CxxThrowException@8.LIBCMT ref: 6CC58CE1
__CxxThrowException@8.LIBCMT ref: 6CC58CF8
FindClose.KERNEL32(FFFFFFFF,?), ref: 6CC58EA0
__CxxThrowException@8.LIBCMT ref: 6CC5997B

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Strings

rar, xrefs: 6CC590BC
001, xrefs: 6CC59003

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$CloseFind$ExceptionRaise_malloc
String ID: 001$rar
API String ID: 231924613-402399766
Opcode ID: f157bda0603d1e1d837dafe979675dbdc8ee491550b69e3d1dfdfaedbc6021ee
Instruction ID: 4fe7fb82d4d172c4688f8d64ae16c94c92dabfae7e1b5ead6f5f711c10d744ec
Opcode Fuzzy Hash: f157bda0603d1e1d837dafe979675dbdc8ee491550b69e3d1dfdfaedbc6021ee
Instruction Fuzzy Hash: F3925AB55083819FD324CF29C480A9BFBF5BF88308F548A6DE59A87750E731E816CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6CC72A30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6CC72B0E
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6CC72B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6CC72B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6CC72B48
FindResourceW.KERNEL32(6CC50000,00000068,RC_DATA), ref: 6CC72B7E
LoadLibraryW.KERNEL32(?,?), ref: 6CC72BA7

Strings

RC_DATA, xrefs: 6CC72B76
7z.dll, xrefs: 6CC72AAC

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource_memset
String ID: 7z.dll$RC_DATA
API String ID: 597928718-3209790242
Opcode ID: 04520c4111c290ee1836deeb602f8886e26558ad3acaa9e22755ed6157c2a6ae
Instruction ID: 42cc22d37b5d89fa83feb4d60cf99ed357cfec9f383cb479243b5a719166f132
Opcode Fuzzy Hash: 04520c4111c290ee1836deeb602f8886e26558ad3acaa9e22755ed6157c2a6ae
Instruction Fuzzy Hash: 9141B2716093419FC720DF24C848B9B7BF8EB8A358F540A1DE54697780FB35D5198B62

Uniqueness

Uniqueness Score: -1.00%

Function 6CC635F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6CC637C4
GetLastError.KERNEL32(?), ref: 6CC637D1

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: 9f9a2f8678d3b48b29f9e959fcdd6838fe377665cdc5bc0cf1ead933a3ec4a75
Instruction ID: daaedb9f4045b16765648094d1e5fc25d30e298a0253c506fc78311bb6e44294
Opcode Fuzzy Hash: 9f9a2f8678d3b48b29f9e959fcdd6838fe377665cdc5bc0cf1ead933a3ec4a75
Instruction Fuzzy Hash: 838290716083809FD724CF15C580B9BB7E5FF89318F144A1DE98A97B50E771E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC72980 Relevance: 10.6, APIs: 7, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadResource.KERNEL32(6CC50000,00000000,6CC50000,?,?,6CC72B94,?), ref: 6CC72993
SizeofResource.KERNEL32(6CC50000,00000000), ref: 6CC729A1
LockResource.KERNEL32(00000000), ref: 6CC729AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6CC729CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6CC729E5
FindCloseChangeNotification.KERNEL32(00000000), ref: 6CC729FA
DeleteFileW.KERNEL32(00000000), ref: 6CC72A0A

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: FileResource$ChangeCloseCreateDeleteFindLoadLockNotificationSizeofWrite
String ID:
API String ID: 290882627-0
Opcode ID: db65babe239e57f152498a2b0d313eb53c80118b14cf0a569d9327bfe14c5cda
Instruction ID: a5dcef1f4a3b4ffaf625ce5f241a1cc4d7ca15eb3fd80006bd040b93a8c75ef9
Opcode Fuzzy Hash: db65babe239e57f152498a2b0d313eb53c80118b14cf0a569d9327bfe14c5cda
Instruction Fuzzy Hash: CD112631742604BBDB308AA98C5CF9BBB7CDB8B661F244165FE40E7280E771880282B0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC64C00 Relevance: 9.6, APIs: 6, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CC62470: FindClose.KERNEL32(?,B4419C60,6CC80658,00000000), ref: 6CC624C4
Part of subcall function 6CC62470: FindFirstFileW.KERNEL32(6CC850B8,?,B4419C60,6CC80658,00000000), ref: 6CC624DE
Part of subcall function 6CC62470: FindFirstFileW.KERNEL32(?,?), ref: 6CC6253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6CC64CE0

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 35ade9f95fe9e36efa3f517109b843cc4880b4be2cfc3f975de42308fe6238fd
Instruction ID: d28387a08264ffae3aa9cdbe5b3378b473714999bd413a331c6f6d6ccd775f44
Opcode Fuzzy Hash: 35ade9f95fe9e36efa3f517109b843cc4880b4be2cfc3f975de42308fe6238fd
Instruction Fuzzy Hash: 03325AB15083808FD720CF69C980A9BB7E4FFC9318F144A2EE59997750E771E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CC62470 Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,B4419C60,6CC80658,00000000), ref: 6CC624C4
FindFirstFileW.KERNEL32(6CC850B8,?,B4419C60,6CC80658,00000000), ref: 6CC624DE
FindFirstFileW.KERNEL32(?,?), ref: 6CC6253A

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: e8f8e4b4df623340fbdf5f3796db4c3f21d0327500e4e49d00f17895b1e2bc79
Instruction ID: e2df395b16170375b58bd07f63714938f971c1708495a3e0841a55720f3d72aa
Opcode Fuzzy Hash: e8f8e4b4df623340fbdf5f3796db4c3f21d0327500e4e49d00f17895b1e2bc79
Instruction Fuzzy Hash: 403161715097429FC710DF25C958AABBBF4FF49328F100B1DE4A5D3A80E735A909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CC682B0 Relevance: 51.5, APIs: 28, Strings: 1, Instructions: 779
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6CC684B2
__CxxThrowException@8.LIBCMT ref: 6CC68687
__CxxThrowException@8.LIBCMT ref: 6CC686ED
__CxxThrowException@8.LIBCMT ref: 6CC68708
__CxxThrowException@8.LIBCMT ref: 6CC68723
__CxxThrowException@8.LIBCMT ref: 6CC6874D
__CxxThrowException@8.LIBCMT ref: 6CC6882F
__CxxThrowException@8.LIBCMT ref: 6CC68A68
__CxxThrowException@8.LIBCMT ref: 6CC68A83
__CxxThrowException@8.LIBCMT ref: 6CC68A9E
__CxxThrowException@8.LIBCMT ref: 6CC68AF2
__CxxThrowException@8.LIBCMT ref: 6CC68324

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

__CxxThrowException@8.LIBCMT ref: 6CC68390
_malloc.LIBCMT ref: 6CC683B1
__CxxThrowException@8.LIBCMT ref: 6CC683CB
__CxxThrowException@8.LIBCMT ref: 6CC68416
__CxxThrowException@8.LIBCMT ref: 6CC68468
__CxxThrowException@8.LIBCMT ref: 6CC68CE4
__CxxThrowException@8.LIBCMT ref: 6CC68CF9
__CxxThrowException@8.LIBCMT ref: 6CC68D14

Strings

7zCon.sfx, xrefs: 6CC684F2

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: 7zCon.sfx
API String ID: 1305767944-1084822657
Opcode ID: ada0e9c5f9130dbb05a2505f5b6caa63151b092e05d1f4325f1882cd8d579162
Instruction ID: 91a01b51a5dbc9ff639c54794a9ea73082f3f6a18204330d18bf2db7ed590649
Opcode Fuzzy Hash: ada0e9c5f9130dbb05a2505f5b6caa63151b092e05d1f4325f1882cd8d579162
Instruction Fuzzy Hash: 5E62A171C01258DFDB21CBA5C980FDEB7B8AF49308F1485DAD548A7A41EB709B89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CC73EF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-i, xrefs: 6CC73FF8, 6CC74110
-x, xrefs: 6CC741BA, 6CC74256
!, xrefs: 6CC74375
-p, xrefs: 6CC742F4
7za L , xrefs: 6CC73F2F

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID:
String ID: -i$ -p$ -x$!$7za L
API String ID: 0-2873427068
Opcode ID: 4597bd1029fc7065217004273622dd43e26df07cd88b446a46f4ed3170bc880c
Instruction ID: 2d2c1d6cc303aa063399c1e231c6f7e242e8c39de5fdc558aec554c6f92cc906
Opcode Fuzzy Hash: 4597bd1029fc7065217004273622dd43e26df07cd88b446a46f4ed3170bc880c
Instruction Fuzzy Hash: A1F1A572901248EBDF15DBE4C944ACFBBB8EF54308F248559E505AB741FB74AA08CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC542E0 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CC52670: __CxxThrowException@8.LIBCMT ref: 6CC52688

Part of subcall function 6CC54D10: _malloc.LIBCMT ref: 6CC54D3A
Part of subcall function 6CC54D10: __CxxThrowException@8.LIBCMT ref: 6CC54D54

__CxxThrowException@8.LIBCMT ref: 6CC546C2

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

__CxxThrowException@8.LIBCMT ref: 6CC54855
__CxxThrowException@8.LIBCMT ref: 6CC54876
CharUpperW.USER32(?), ref: 6CC54943

Strings

Incorrect command line, xrefs: 6CC5431B, 6CC5433E, 6CC5454F, 6CC54579, 6CC548F9
Cannot use absolute pathnames for this command, xrefs: 6CC54521

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$CharExceptionRaiseUpper_malloc
String ID: Cannot use absolute pathnames for this command$Incorrect command line
API String ID: 2609558216-724315024
Opcode ID: 77e57ab17e442d0b5c6b5867c1e8d375486f86db2fcf8a42bbd8cf77bd7dd32a
Instruction ID: 69b089ededda35a97c0b504a35a8d76e1e592d2c25946877f85200b819f76610
Opcode Fuzzy Hash: 77e57ab17e442d0b5c6b5867c1e8d375486f86db2fcf8a42bbd8cf77bd7dd32a
Instruction Fuzzy Hash: D922D3715083409FD701CF14C484B9BBBE5AF8530CF98899CE4994BB92E770E979CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6CC669E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,B4419C60,6CC8FCC8,00000000), ref: 6CC66A18
FreeLibrary.KERNEL32(00000000), ref: 6CC66A38
FreeLibrary.KERNEL32(00000000,B4419C60,6CC8FCC8,00000000), ref: 6CC66A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 6CC66AA5

Strings

CreateObject, xrefs: 6CC66A9D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: 204cd151218048122ead577ad9d79624137b105eb3174500cf960b35af8db75c
Instruction ID: 66b2d28d26ab9acb19fbc20250837a73c4a7464169c78ce6f90d598abc16c62c
Opcode Fuzzy Hash: 204cd151218048122ead577ad9d79624137b105eb3174500cf960b35af8db75c
Instruction Fuzzy Hash: B7417E75A41A05EFDB00CF66C580B9ABBF5FF49314F10861AE825DBB80E734E941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5C2D0 Relevance: 7.6, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 6CC5C32F

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

_malloc.LIBCMT ref: 6CC5C313

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

_malloc.LIBCMT ref: 6CC5C353
__CxxThrowException@8.LIBCMT ref: 6CC5C36F
GetLastError.KERNEL32(6CC84C28,80000000,00000001,00000003), ref: 6CC5C3BC

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 2571202727-0
Opcode ID: 67598317067fb184164d91c0889b05dd39baa059a7982edf34523b97b30fb448
Instruction ID: e7e3846345c7e58ea4f02a8e84e600ed968e611541dbd33c6d4dd003098155fb
Opcode Fuzzy Hash: 67598317067fb184164d91c0889b05dd39baa059a7982edf34523b97b30fb448
Instruction Fuzzy Hash: 8541B372601609AFDB10DF99C880B9BBBF8FF49314F108659E95597B80E770D916C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC65F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6CC65F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6CC65F9F

Strings

GetMethodProperty, xrefs: 6CC65F77
GetNumberOfMethods, xrefs: 6CC65F99

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: 5452f9e35e911da5b9f696ea5c88b8fc83df0311eba9067f00fd30b755adbb21
Instruction ID: cd9dab924766efa871ce3f16fcb96d3001f7ab7426e45c317a757e325c14e30b
Opcode Fuzzy Hash: 5452f9e35e911da5b9f696ea5c88b8fc83df0311eba9067f00fd30b755adbb21
Instruction Fuzzy Hash: 15215175E01219ABCB00CF96DAC09DEF7B9FF48348B244025E805A7B01F771E906CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC58670 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6CC58916
__CxxThrowException@8.LIBCMT ref: 6CC5892C

Strings

<H, xrefs: 6CC5896F

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorException@8LastThrow
String ID: <H
API String ID: 1006195485-4022674625
Opcode ID: 6251e98b337458dba79868a72e66022b2780f400046567d1f03d4a516f6c3527
Instruction ID: 30bc067b614233ebb64bfe9774f7e8560f6732bc5e5aa0ac44209e5a104ecc8c
Opcode Fuzzy Hash: 6251e98b337458dba79868a72e66022b2780f400046567d1f03d4a516f6c3527
Instruction Fuzzy Hash: 6CE1A3B5D01248AFDB00DFE8C9809DEBBB5FF48304F64815EE516AB740E730AA15CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5CAE0 Relevance: 4.8, APIs: 3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6CC5CB18

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC5CB30

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Part of subcall function 6CC5A910: __CxxThrowException@8.LIBCMT ref: 6CC5A992

GetLastError.KERNEL32(?,00000000,00000000), ref: 6CC5CBD3

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$AllocateErrorExceptionHeapLastRaise_malloc
String ID:
API String ID: 214124409-0
Opcode ID: 901ffa5c2b638954c2585716a2d2dcaef17f8d5d01295302e8823be57573641f
Instruction ID: 5c991fc4c806f48a2a8e086534e7dc48999537059bf7477ddd3cea808ee48ab5
Opcode Fuzzy Hash: 901ffa5c2b638954c2585716a2d2dcaef17f8d5d01295302e8823be57573641f
Instruction Fuzzy Hash: 52A163B1D00248AFCF04DFA8D980ADEB7B4FF48318F144569E915A7740E735EA29CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC62A70 Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,B4419C60,?,00000000,?,?,00000000,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC62A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,B4419C60,?,00000000,?,?,00000000), ref: 6CC62ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CC62B2B

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: bb98e358cb805e8b4e8c8778e9d5ea90d8740ac6c52a85720ac01cbb25d4139b
Instruction ID: b26b209da8986b1fc0dccdcef233d66e7a1b5089b735172d89fc44ba50cee408
Opcode Fuzzy Hash: bb98e358cb805e8b4e8c8778e9d5ea90d8740ac6c52a85720ac01cbb25d4139b
Instruction Fuzzy Hash: 9F31A171A0120AAFDB10CF64CC45BABBBB8FB45724F204719F825A77C0E730A915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC61340 Relevance: 4.6, APIs: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,B4419C60,?,?,?,?,?,00000000), ref: 6CC6136E
GetLastError.KERNEL32 ref: 6CC6138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 6CC613D7

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 9788399972b48156c33954fc7e561ecad5ac3c2a4358a419ed2f57482d281814
Instruction ID: f320b41ed3dc72109fc448867e5da4bed26456fdd919a8c6df47b1338d666907
Opcode Fuzzy Hash: 9788399972b48156c33954fc7e561ecad5ac3c2a4358a419ed2f57482d281814
Instruction Fuzzy Hash: BF21D373E056049BDB10CF99D8457EFBBB8EB46626F10017AED05A3B40EB369905C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC51AB0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 6CC51AEC
GetLastError.KERNEL32 ref: 6CC51B01

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a851be02af09d0fb94543c6557cbde5262a1ea073f6082d32b7a6395b0f731f7
Instruction ID: 6e440b0592c60abc07291f216d37746df766408ac64cce73199224a2608c2eae
Opcode Fuzzy Hash: a851be02af09d0fb94543c6557cbde5262a1ea073f6082d32b7a6395b0f731f7
Instruction Fuzzy Hash: C511D3B6B0620A4B8700CE6DE8449AB7BE8EB85321F10822EFD14C7660F732D43597E5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC53E70 Relevance: 3.2, APIs: 2, Instructions: 250COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC54042

Part of subcall function 6CC54D10: _malloc.LIBCMT ref: 6CC54D3A
Part of subcall function 6CC54D10: __CxxThrowException@8.LIBCMT ref: 6CC54D54

__CxxThrowException@8.LIBCMT ref: 6CC541B5

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID:
API String ID: 175252994-0
Opcode ID: 060259eeb703d635087967f26f87ab2e5d86094cc82e90c6da122884a51fef7b
Instruction ID: 26b8075fd2a12a3d684132d57b0164fc77dbea6213a0abd23e5f6a33958ab967
Opcode Fuzzy Hash: 060259eeb703d635087967f26f87ab2e5d86094cc82e90c6da122884a51fef7b
Instruction Fuzzy Hash: 04B116B1D01258DBDB10CF99C980ADEFBB4BF08304FA481AEE51AA7740E7345A59CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CC61060 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,B4419C60,?,00000000,?,?,00000000,?,B4419C60,00000000), ref: 6CC6108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 6CC610ED

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 62f785814cd8d7e2bcdaf81191c614dc6a5e4bd98f2bcdb114f99d466539c53a
Instruction ID: 01ff17edb462d954cced3ee0040335fc910ff786f0b45b1c852c6c192aac0b60
Opcode Fuzzy Hash: 62f785814cd8d7e2bcdaf81191c614dc6a5e4bd98f2bcdb114f99d466539c53a
Instruction Fuzzy Hash: 4921C473E056089BDF00CF99D946BDFFBB8EB45629F10016AE908D3740EB35AA05C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC677E0 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC677E6

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC67803

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 8864b617a02359347f7a536a2a99390d9d2430bf500ea68b08838cbb9106f3f8
Instruction ID: 59684dea46d6bad785108ffdd62cbb3f2ac04f217e50a584bd185c55911639ec
Opcode Fuzzy Hash: 8864b617a02359347f7a536a2a99390d9d2430bf500ea68b08838cbb9106f3f8
Instruction Fuzzy Hash: 95019E71501205EBDB04CE5AC4D099AB3A9EF59318F0484AAEC05AFF45FB71EE45DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC51C20 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6CC51C4C
GetLastError.KERNEL32 ref: 6CC51C75

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 5dae9efe333bdf25a55a948d755b15dc228283a3b481bb0391dd79f141f5c833
Instruction ID: 6146cc447677b37a8c8eccbf07a4d942960951da32e201705d9ee8fc8c6059bd
Opcode Fuzzy Hash: 5dae9efe333bdf25a55a948d755b15dc228283a3b481bb0391dd79f141f5c833
Instruction Fuzzy Hash: 1101A23270130A9BD710CE58D844BA737F8BB04704F40492AF916DB980E376E8318BA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC519C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6CC519EB
GetLastError.KERNEL32 ref: 6CC51A0C

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 984dfb5ab95badacb1ad40d2d34f23170b0a069e60904117fbba12aa19595ec5
Instruction ID: de9ee24920336acc78b3921bd2af43b289aedc69fc060c4d0ba5e82ed2bc8a28
Opcode Fuzzy Hash: 984dfb5ab95badacb1ad40d2d34f23170b0a069e60904117fbba12aa19595ec5
Instruction Fuzzy Hash: 60F0AF7635020A9BDB00CE58D848B6737A9BB84314F10C52AF819CB680E775D8718B64

Uniqueness

Uniqueness Score: -1.00%

Function 6CC51BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,6CC6B356,?,?,?,?,?,?,6CC85380,?), ref: 6CC51BE9
GetLastError.KERNEL32(?,?,?,?,?,?,6CC85380,?), ref: 6CC51BFD

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 4389519e8c58fe1287045f1c5edb8f2880934d59eddbcfb1844e3d40ef4f1e93
Instruction ID: ad9e341d38f6bc7e3ca4ff52c75c9192ac01f8d2fda0b5807d3ec0cd763047b7
Opcode Fuzzy Hash: 4389519e8c58fe1287045f1c5edb8f2880934d59eddbcfb1844e3d40ef4f1e93
Instruction Fuzzy Hash: 10E012B8B51A035ADB104E3DCC4C32679B46B0273A7E48B28E076D68E0F72DD0728A08

Uniqueness

Uniqueness Score: -1.00%

Function 6CC609E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC609E8

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC60A02

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 4a7cece484938596848f8f47272bc67adec6e58558574200314fcb2248ee3773
Instruction ID: acdcd41bb56c69956200822a86e31c93b8eba19274f61892fb9407e359de513c
Opcode Fuzzy Hash: 4a7cece484938596848f8f47272bc67adec6e58558574200314fcb2248ee3773
Instruction Fuzzy Hash: 6DD05EA080A248728A04C6A6A84199E7BAC8A1524CF400299BC0993E02FA32D61E42A5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC57350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,B4419C60,?,?,?,?,?,6CC80300,000000FF), ref: 6CC57438

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: c7350521bb98e66ad92a64c237f9133a1f3e6485ca795c7eb73054bcf3167acc
Instruction ID: 8a63a6f597d6d14a4ad021eea1da1dace8b813ff9b007ae04833d421c6ecb836
Opcode Fuzzy Hash: c7350521bb98e66ad92a64c237f9133a1f3e6485ca795c7eb73054bcf3167acc
Instruction Fuzzy Hash: 9C5190B1A15A82AFD708CF75C480B95FBA0FB09318F90865DD46D87E01E731B8B4EB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5A910 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6CC625A0: FindClose.KERNEL32(FFFFFFFF,?,B4419C60,?,00000000,6CC850B8,?,6CC80438,000000FF,?,6CC6265E), ref: 6CC625EA

__CxxThrowException@8.LIBCMT ref: 6CC5A992

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CloseExceptionException@8FindRaiseThrow
String ID:
API String ID: 2665002293-0
Opcode ID: 6cad88667721e2edb622c86b983671d08e6d3488cf7d1a140b3eb7b84457d6db
Instruction ID: 09ab3eb3c60d49b19ad97856064a65933ab619e94a98cebc661cce8e62d24f37
Opcode Fuzzy Hash: 6cad88667721e2edb622c86b983671d08e6d3488cf7d1a140b3eb7b84457d6db
Instruction Fuzzy Hash: F71163B2500744ABC710CF69C880EDBFBF8FF55318F50461EE95683B50EB35A5098BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC61420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6CC5890F,B4419C60,?,?,00000000), ref: 6CC61528

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4bdb5883da022db16b86a1d30c4970221908e223630ac45277e18997f018307c
Instruction ID: 4848bc8498803e71ef5ad245cbe4e9973d554a98b172e7327cfec4980f6557c3
Opcode Fuzzy Hash: 4bdb5883da022db16b86a1d30c4970221908e223630ac45277e18997f018307c
Instruction Fuzzy Hash: 65B18575D002099BCF14CFA9DA816EEB7B5FF44309F184169D806A7F40FB35E9198BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC625A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6CC62470: FindClose.KERNEL32(?,B4419C60,6CC80658,00000000), ref: 6CC624C4
Part of subcall function 6CC62470: FindFirstFileW.KERNEL32(6CC850B8,?,B4419C60,6CC80658,00000000), ref: 6CC624DE
Part of subcall function 6CC62470: FindFirstFileW.KERNEL32(?,?), ref: 6CC6253A

FindClose.KERNEL32(FFFFFFFF,?,B4419C60,?,00000000,6CC850B8,?,6CC80438,000000FF,?,6CC6265E), ref: 6CC625EA

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9ec87f2f10d9a8b56bf758a60111cb1e154b0dfbd4bc817dd3691439dee8862
Instruction ID: ee2a5ad67ccf941be002d4cb8cf723cb09c15b903dbcb053b8c4cb20eec6fc20
Opcode Fuzzy Hash: c9ec87f2f10d9a8b56bf758a60111cb1e154b0dfbd4bc817dd3691439dee8862
Instruction Fuzzy Hash: 00F062B6945648AFC710CF59C844FABB7B8FB06724F50071AF43193BC0D73569058A60

Uniqueness

Uniqueness Score: -1.00%

Function 6CC51950 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 6CC5196C

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 08b0e8dd326f45b5362a0d12f756ee6a5acae2e26371f31a41e3dd2320615e10
Instruction ID: 2badad511d341f74f1bb19afe5b16e4ef82be072044711b7fd9b5d0c54f64196
Opcode Fuzzy Hash: 08b0e8dd326f45b5362a0d12f756ee6a5acae2e26371f31a41e3dd2320615e10
Instruction Fuzzy Hash: F7E092B260271016C2109F699809B47BBDC9F022B9B608B18E47987AD0E371D421C794

Uniqueness

Uniqueness Score: -1.00%

Function 6CC793E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6CC76375,00000001,?,?,?,6CC764EE,?,?,?,6CC87F18,0000000C,6CC765A9), ref: 6CC793F6

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 88e79978bc0467462b85377d3503bde573e83d467808882a9f24e0510731a113
Instruction ID: 2371a0d35faf167fcafe2906d1bf1ddf8ff0fa68a4ed01834329ee36c6deac57
Opcode Fuzzy Hash: 88e79978bc0467462b85377d3503bde573e83d467808882a9f24e0510731a113
Instruction Fuzzy Hash: 92D05E727553485EDB006EB59C08B233FFCE787799F048476B90CC7540F670C5508610

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CC751C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CC76B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CC76BA6
UnhandledExceptionFilter.KERNEL32(6CC83328), ref: 6CC76BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 6CC76BCD
TerminateProcess.KERNEL32(00000000), ref: 6CC76BD4

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f7ea61577e14bcc833e7eb4d29b6347d1aeca409d640c3811c4f225e89f6e95
Instruction ID: af6dd7c6b781da2a3a0526d0732290b11b726db25717487373333bcd225adb58
Opcode Fuzzy Hash: 6f7ea61577e14bcc833e7eb4d29b6347d1aeca409d640c3811c4f225e89f6e95
Instruction Fuzzy Hash: C321EDB8A02305DFDF00DF29C589A463FB4FB0B71AF61501AE909D7740E7B459868F21

Uniqueness

Uniqueness Score: -1.00%

Function 6CC52AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6CC52BB4
GetLastError.KERNEL32 ref: 6CC52BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6CC52BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 6CC52C88
CloseHandle.KERNEL32(?), ref: 6CC52C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 6CC52CA8
GetLastError.KERNEL32 ref: 6CC52CBD
SetEvent.KERNEL32(00000000), ref: 6CC52CC4
GetLastError.KERNEL32 ref: 6CC52CCE
CloseHandle.KERNEL32(00000000), ref: 6CC52CD5
GetLastError.KERNEL32 ref: 6CC52CDF

Part of subcall function 6CC52670: __CxxThrowException@8.LIBCMT ref: 6CC52688

Strings

Incorrect command line, xrefs: 6CC52B13, 6CC52B63
data error, xrefs: 6CC52C6A
Can not open mapping, xrefs: 6CC52BCD
MapViewOfFile error, xrefs: 6CC52BEE
Incorrect mapping data, xrefs: 6CC52C02

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$Exception@8MappingThrowUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 682782048-464465891
Opcode ID: 3a63f1ff41cab445160bdb91efd6250046642837f9ec06fc266624e1029e3fb1
Instruction ID: 986aa1142c4c7fc1a5eae0eaecc66a84a0380bb02a774176dd18cdcca0c5f45b
Opcode Fuzzy Hash: 3a63f1ff41cab445160bdb91efd6250046642837f9ec06fc266624e1029e3fb1
Instruction Fuzzy Hash: 1D61F671E016099BDB01CFA8C858BDEBBF4EF45358F544124E901A7B40FB70E92587A9

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7715B Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6CC87F58,0000000C,6CC77296,00000000,00000000,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B), ref: 6CC7716D
__crt_waiting_on_module_handle.LIBCMT ref: 6CC77178

Part of subcall function 6CC77790: Sleep.KERNEL32(000003E8,?,?,6CC770BE,KERNEL32.DLL,?,6CC794A4,?,6CC75FE3,6CC5FA7E,?,?,6CC54D3F,0000000C,B4419C60,?), ref: 6CC7779C
Part of subcall function 6CC77790: GetModuleHandleW.KERNEL32(6CC5FA7E,?,6CC770BE,KERNEL32.DLL,?,6CC794A4,?,6CC75FE3,6CC5FA7E,?,?,6CC54D3F,0000000C,B4419C60,?,?), ref: 6CC777A5

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6CC771A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6CC771B1
__lock.LIBCMT ref: 6CC771D3
InterlockedIncrement.KERNEL32(02C08302), ref: 6CC771E0
__lock.LIBCMT ref: 6CC771F4
___addlocaleref.LIBCMT ref: 6CC77212

Strings

KERNEL32.DLL, xrefs: 6CC77167, 6CC7716C, 6CC77177
DecodePointer, xrefs: 6CC771A9
EncodePointer, xrefs: 6CC77195

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 4754a6f57d3b0af658247ad622aaed49ef2b2045dd3343fb456013769712831b
Instruction ID: 546318244b442845b362790b824af775be4d57f3df9d95c89748ceeaac622989
Opcode Fuzzy Hash: 4754a6f57d3b0af658247ad622aaed49ef2b2045dd3343fb456013769712831b
Instruction Fuzzy Hash: 581190715027059BDB21DF79C801B9BBFF0EF01328F14455AE4A9E7B90EB34A544DB64

Uniqueness

Uniqueness Score: -1.00%

Function 6CC70680 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

Part of subcall function 6CC71230: _malloc.LIBCMT ref: 6CC71258
Part of subcall function 6CC71230: __CxxThrowException@8.LIBCMT ref: 6CC71272

__CxxThrowException@8.LIBCMT ref: 6CC70704

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68324
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68390
Part of subcall function 6CC682B0: _malloc.LIBCMT ref: 6CC683B1
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC683CB
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68416

Part of subcall function 6CC75FF4: __lock.LIBCMT ref: 6CC76012
Part of subcall function 6CC75FF4: ___sbh_find_block.LIBCMT ref: 6CC7601D
Part of subcall function 6CC75FF4: ___sbh_free_block.LIBCMT ref: 6CC7602C
Part of subcall function 6CC75FF4: HeapFree.KERNEL32(00000000,6CC5FA7E,6CC87EB0,0000000C,6CC781B5,00000000,6CC88028,0000000C,6CC781EF,6CC5FA7E,?,?,6CC7C6AB,00000004,6CC882E8,0000000C), ref: 6CC7605C
Part of subcall function 6CC75FF4: GetLastError.KERNEL32(?,6CC7C6AB,00000004,6CC882E8,0000000C,6CC77669,6CC5FA7E,?,00000000,00000000,00000000,?,6CC7726D,00000001,00000214), ref: 6CC7606D

__CxxThrowException@8.LIBCMT ref: 6CC70A37

Strings

-w, xrefs: 6CC7077E
7za , xrefs: 6CC706D6
-mhe, xrefs: 6CC708F0
-sfx, xrefs: 6CC70723
-ssw, xrefs: 6CC70736

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$_malloc$ErrorExceptionFreeHeapLastRaise___sbh_find_block___sbh_free_block__lock
String ID: -mhe$ -sfx$ -ssw$ -w$7za
API String ID: 1499254937-429077366
Opcode ID: 9a051f9bfbba4bb5fa444ddee982fcf6e40ad286552d78faa3131c1c1185d0d6
Instruction ID: bcdf39659fe4c1acecec2696d9d3062f4e25214f985806021ae806902c2814a6
Opcode Fuzzy Hash: 9a051f9bfbba4bb5fa444ddee982fcf6e40ad286552d78faa3131c1c1185d0d6
Instruction Fuzzy Hash: 56C16E718012889BDF10DFE8C984BDEBBB8AF14308F544559D805ABB45F7B5AA1CCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC66530 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 323libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6CC66AD8,GetHandlerProperty2), ref: 6CC66584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6CC66595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6CC665B1

Strings

GetHandlerProperty, xrefs: 6CC6658F
GetHandlerProperty2, xrefs: 6CC66579
GetNumberOfFormats, xrefs: 6CC665AB

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats
API String ID: 190572456-3564775856
Opcode ID: a52d6888fa670dceed01ac8eb63d1ce97debf414b6690e26a44f6b296d4c9521
Instruction ID: b7e67fca4d69a7c0bc3c606e1418e17061faecd7ea60374736a0615d516c4244
Opcode Fuzzy Hash: a52d6888fa670dceed01ac8eb63d1ce97debf414b6690e26a44f6b296d4c9521
Instruction Fuzzy Hash: 72D13AB1D006589BDB24DFAAC980BDEBBB4BF48314F1041ADD559E7B40EB309A45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CC70AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC70C28
__CxxThrowException@8.LIBCMT ref: 6CC70C42
__CxxThrowException@8.LIBCMT ref: 6CC70D3F

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

__CxxThrowException@8.LIBCMT ref: 6CC70D54

Strings

7za l, xrefs: 6CC70AE6
-an, xrefs: 6CC70BF4

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: -an$7za l
API String ID: 1305767944-193614407
Opcode ID: be56522f857e3fdb3c0b3538554ad53422fe97b81ef3ef765e5012cb405f237b
Instruction ID: 95efde55cb004960ffcf2da4d934a37ab521fcd464e481853bdfdfdf8ecc17a7
Opcode Fuzzy Hash: be56522f857e3fdb3c0b3538554ad53422fe97b81ef3ef765e5012cb405f237b
Instruction Fuzzy Hash: EA917F71901248DFDF10DFA8C980BCEBBB4EF15308F544599E805ABB41EB75EA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7E5CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBCMT ref: 6CC7E624

Part of subcall function 6CC7E370: PMDtoOffset.LIBCMT ref: 6CC7E400

FindVITargetTypeInstance.LIBCMT ref: 6CC7E62B
PMDtoOffset.LIBCMT ref: 6CC7E63B
std::bad_exception::bad_exception.LIBCMT ref: 6CC7E661
__CxxThrowException@8.LIBCMT ref: 6CC7E66F

Strings

Bad dynamic_cast!, xrefs: 6CC7E659

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 3308565544-2956939130
Opcode ID: 950069841f896644a977fe5d5323e1b7985912d14c576b4bca8dfa2f55c1a66e
Instruction ID: a2f2f2706f2db3e22781277342d869007692928a691b1d6fc818d2e284ce7620
Opcode Fuzzy Hash: 950069841f896644a977fe5d5323e1b7985912d14c576b4bca8dfa2f55c1a66e
Instruction Fuzzy Hash: EB118933A002099FDB20DEA9C940ADE77B4EF59328F140558E410EBA90FB34DA058BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC60450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6CC62A70: CloseHandle.KERNEL32(?,B4419C60,?,00000000,?,?,00000000,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC62A9F
Part of subcall function 6CC62A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,B4419C60,?,00000000,?,?,00000000), ref: 6CC62ACC
Part of subcall function 6CC62A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6CC62B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,B4419C60,?,?,00000000,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC604A7
GetLastError.KERNEL32(?,?,?,00000000,6CC80C38,000000FF), ref: 6CC604B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,B4419C60,?,?,00000000,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC6051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC6053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6CC80C38,000000FF), ref: 6CC6056C

Part of subcall function 6CC60A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,B4419C60,00000000), ref: 6CC60AA7
Part of subcall function 6CC60A20: __CxxThrowException@8.LIBCMT ref: 6CC60AC1

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6CC606D8

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorException@8LastMultiSizeThrowWide
String ID:
API String ID: 1518168698-0
Opcode ID: c4e531271373360163c0dd5ecce88b87b00572647e05eeae83fb638a1b8ad373
Instruction ID: f9ccfa205c4852c6544f4594fcef51e78a6e08222a116701565df98cd70a0433
Opcode Fuzzy Hash: c4e531271373360163c0dd5ecce88b87b00572647e05eeae83fb638a1b8ad373
Instruction Fuzzy Hash: D181A372E002489BCF10DFA5D980BDEB7B4EF45318F244619E915B7B80FB359909CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6CC72CE0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

-r, xrefs: 6CC72DD2
-p, xrefs: 6CC72E33
-ir-!, xrefs: 6CC72FAB
7za A , xrefs: 6CC72D17

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID: -ir-!$ -p$ -r$7za A
API String ID: 3476970888-2239425251
Opcode ID: 1a53240f15f9b88a1b28aa319fa1b33afb20ad7a43b77c4540b8cdcd546d5114
Instruction ID: c4caeb721e0a7a03d319772a32bd0596d0e8d246730a04cfc35a698b95f3fd84
Opcode Fuzzy Hash: 1a53240f15f9b88a1b28aa319fa1b33afb20ad7a43b77c4540b8cdcd546d5114
Instruction Fuzzy Hash: 69028E72D01248DBDF20DBA4C884BCEBBB4EF44308F548599E805A7741FB75AA59CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7ACE3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6CC7AD0B

Part of subcall function 6CC76968: __getptd.LIBCMT ref: 6CC76976
Part of subcall function 6CC76968: __getptd.LIBCMT ref: 6CC76984

__getptd.LIBCMT ref: 6CC7AD15

Part of subcall function 6CC772BB: __getptd_noexit.LIBCMT ref: 6CC772BE
Part of subcall function 6CC772BB: __amsg_exit.LIBCMT ref: 6CC772CB

__getptd.LIBCMT ref: 6CC7AD23
__getptd.LIBCMT ref: 6CC7AD31
__getptd.LIBCMT ref: 6CC7AD3C
_CallCatchBlock2.LIBCMT ref: 6CC7AD62

Part of subcall function 6CC76A0D: __CallSettingFrame@12.LIBCMT ref: 6CC76A59

Part of subcall function 6CC7AE09: __getptd.LIBCMT ref: 6CC7AE18
Part of subcall function 6CC7AE09: __getptd.LIBCMT ref: 6CC7AE26

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 695b6775af41186f33b7f0902cea462219176f8014c34b88e3a72aab16d694f1
Instruction ID: 2cba91aacc0e170cd31e0c6f4482f37a0de56fc6f0c4f2f3d4d12285aef42fa7
Opcode Fuzzy Hash: 695b6775af41186f33b7f0902cea462219176f8014c34b88e3a72aab16d694f1
Instruction Fuzzy Hash: 8211C6B1C00609DFDF11DFA4C584BEE7BB0FF04318F108069E814A7750EB389A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 6CC702B0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC7060F
__CxxThrowException@8.LIBCMT ref: 6CC70329

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

__CxxThrowException@8.LIBCMT ref: 6CC70624

Strings

7za , xrefs: 6CC702F6
-an, xrefs: 6CC70569

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: -an$7za
API String ID: 3476068407-1592202885
Opcode ID: 6ec69981b81603c0a4e11cb3c36cd45d8f2b921af05c02c6eac93dd9cda4cab6
Instruction ID: 5d2445427788a3e3cb55f745ac7bb6b3a0a1e19ad3613ac4630273aa540c76ea
Opcode Fuzzy Hash: 6ec69981b81603c0a4e11cb3c36cd45d8f2b921af05c02c6eac93dd9cda4cab6
Instruction Fuzzy Hash: A7B17071801288EBDF10DFA8C984BCEBBB4AF1430CF504455E905A7B45E775EA58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6F5A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC6F621

Strings

-aoa, xrefs: 6CC6F5C9
-aos, xrefs: 6CC6F5DB
-aou, xrefs: 6CC6F5ED
-aot, xrefs: 6CC6F5FF

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw
String ID: -aoa$ -aos$ -aot$ -aou
API String ID: 2005118841-2698752949
Opcode ID: 0f75fcb79d076288e59afb4d7e96213639e11bce917891cdc263fa757f3413ec
Instruction ID: 59437f9e14b61648c586b61298facbac4339b48641886d6678f3be5424a99a0e
Opcode Fuzzy Hash: 0f75fcb79d076288e59afb4d7e96213639e11bce917891cdc263fa757f3413ec
Instruction Fuzzy Hash: BAF0373470A518A79950CA9CAD0059E779C870695EB804AC6B80ADBB00EBA2CE3613CA

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7AA32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CC7AA4C

Part of subcall function 6CC772BB: __getptd_noexit.LIBCMT ref: 6CC772BE
Part of subcall function 6CC772BB: __amsg_exit.LIBCMT ref: 6CC772CB

__getptd.LIBCMT ref: 6CC7AA5D
__getptd.LIBCMT ref: 6CC7AA6B

Strings

csm, xrefs: 6CC7AA45
MOC, xrefs: 6CC7AA3E

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction ID: 661faa3238eeaccece4b94d258541ed982753e14adaf47f4c053bce5be914f1f
Opcode Fuzzy Hash: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction Fuzzy Hash: 41E04F31110108CFCB20DB64C144B9933A4FB8632CF5511A1E45CC7B22FB34D498AF76

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7C0C6 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CC7C0D2

Part of subcall function 6CC772BB: __getptd_noexit.LIBCMT ref: 6CC772BE
Part of subcall function 6CC772BB: __amsg_exit.LIBCMT ref: 6CC772CB

__amsg_exit.LIBCMT ref: 6CC7C0F2
__lock.LIBCMT ref: 6CC7C102
InterlockedDecrement.KERNEL32(?), ref: 6CC7C11F
InterlockedIncrement.KERNEL32(02901668), ref: 6CC7C14A

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: ce446eec5866dff37914170fb09552952a25a90513da0e4bcdcb679daaf6ab46
Instruction ID: 302072b7d3d530761d518e71fd2b3eb93a74e4ae057d6e67efdea664cf72f6ed
Opcode Fuzzy Hash: ce446eec5866dff37914170fb09552952a25a90513da0e4bcdcb679daaf6ab46
Instruction Fuzzy Hash: CC018431A07A179BDB21AB658404B8B7B70FF06B28F150116E420E7F80EB345985DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC75FF4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6CC76012

Part of subcall function 6CC781D4: __mtinitlocknum.LIBCMT ref: 6CC781EA
Part of subcall function 6CC781D4: __amsg_exit.LIBCMT ref: 6CC781F6
Part of subcall function 6CC781D4: EnterCriticalSection.KERNEL32(?,?,?,6CC7C6AB,00000004,6CC882E8,0000000C,6CC77669,6CC5FA7E,?,00000000,00000000,00000000,?,6CC7726D,00000001), ref: 6CC781FE

___sbh_find_block.LIBCMT ref: 6CC7601D
___sbh_free_block.LIBCMT ref: 6CC7602C
HeapFree.KERNEL32(00000000,6CC5FA7E,6CC87EB0,0000000C,6CC781B5,00000000,6CC88028,0000000C,6CC781EF,6CC5FA7E,?,?,6CC7C6AB,00000004,6CC882E8,0000000C), ref: 6CC7605C
GetLastError.KERNEL32(?,6CC7C6AB,00000004,6CC882E8,0000000C,6CC77669,6CC5FA7E,?,00000000,00000000,00000000,?,6CC7726D,00000001,00000214), ref: 6CC7606D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: e095ff053c54cc7c52faefe40d348dc8c6594a5d5a8522de2ce534e42d2221d5
Instruction ID: 081a07ff94e610f524e4f1da8a1ef45ee14526b6de8715cf3a6fce824f0308ce
Opcode Fuzzy Hash: e095ff053c54cc7c52faefe40d348dc8c6594a5d5a8522de2ce534e42d2221d5
Instruction Fuzzy Hash: 91018FB1906605AAEF315BB1980CB8F7F74EF0236CF204109E610E7980FB348545DBB9

Uniqueness

Uniqueness Score: -1.00%

Function 6CC70DB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC7109D

Part of subcall function 6CC6F640: __CxxThrowException@8.LIBCMT ref: 6CC6F66A

Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68324
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68390
Part of subcall function 6CC682B0: _malloc.LIBCMT ref: 6CC683B1
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC683CB
Part of subcall function 6CC682B0: __CxxThrowException@8.LIBCMT ref: 6CC68416

Strings

-w, xrefs: 6CC70E18
7za d, xrefs: 6CC70DF6
-mhe, xrefs: 6CC70F69

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: -mhe$ -w$7za d
API String ID: 175252994-4051784903
Opcode ID: 7ad42432f99ad40007636140be1fcddc100cc37141023bfe21c4ac6aec1baa9c
Instruction ID: 969342247f03338bcae5701d0a61c8b778cf6b4dc7c352cfa1d084dfcab8963c
Opcode Fuzzy Hash: 7ad42432f99ad40007636140be1fcddc100cc37141023bfe21c4ac6aec1baa9c
Instruction Fuzzy Hash: 8A917071D01288EFDF10DFA8C984BCEBBB8AF14308F544459D805A7741E775EA59CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC65BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6CC7FD48,B4419C60,00000000,?,80000001,00000000,6CC7FD48,000000FF,?,6CC65DBD,?,6CC8FCC8), ref: 6CC65C1D

Part of subcall function 6CC62FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CC65DBD,?,?,6CC65C37,?,6CC65DBD,?,6CC8FCC8,00000000,00000000), ref: 6CC6300E
Part of subcall function 6CC62FE0: RegQueryValueExW.ADVAPI32(6CC65DBD,Path,00000000,6CC65DBD,?,6CC65DBD,?,6CC65DBD,?,6CC8FCC8,00000000,00000000), ref: 6CC6304E

RegCloseKey.ADVAPI32(?,?,6CC65DBD,?,6CC8FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CC65C47
RegCloseKey.ADVAPI32(?,?,6CC65DBD,?,6CC8FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CC65C65

Strings

Software\7-zip, xrefs: 6CC65C11

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: 068ff33f3de7d590fe71a0a43b8678c03e12669499e15b60103bc6b85d628167
Instruction ID: 50dd5ccfa70cb5c95f01774bbd06eebc0a4bc15fd178df252b942f6126277207
Opcode Fuzzy Hash: 068ff33f3de7d590fe71a0a43b8678c03e12669499e15b60103bc6b85d628167
Instruction Fuzzy Hash: B3117772E05A24BBC7118F45DD84AAFBB78FB06B28F10065BFC15A7B40E734550586D4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7B090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6CC7B0A3

Part of subcall function 6CC7AFFE: ___BuildCatchObjectHelper.LIBCMT ref: 6CC7B034

_UnwindNestedFrames.LIBCMT ref: 6CC7B0BA
___FrameUnwindToState.LIBCMT ref: 6CC7B0C8

Strings

csm, xrefs: 6CC7B09F, 6CC7B0B4, 6CC7B0C7, 6CC7B0E5, 6CC7B0F5

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction ID: 554f6e275bd8e4eef3053bbe17c1b021b35b3a8d58b2aaf788c9ae0ef886a391
Opcode Fuzzy Hash: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction Fuzzy Hash: 4101D2B100150ABBDF225E51CC44AEB7E6AFF48358F104010FD2855A20EB32E9A6DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6F640 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC6F66A

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Strings

-r-, xrefs: 6CC6F681
-r, xrefs: 6CC6F693
-r0, xrefs: 6CC6F66F

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: -r$ -r-$ -r0
API String ID: 3976011213-1696425382
Opcode ID: 18d9e9deaf88325f4d5035ec5aa49292d4291ebc009fa72a022f87e651c3f38a
Instruction ID: d3b5c5deb919b99b38869be03bf5b8c4a14ca0ce1552fe40fe85b30af1f6b352
Opcode Fuzzy Hash: 18d9e9deaf88325f4d5035ec5aa49292d4291ebc009fa72a022f87e651c3f38a
Instruction Fuzzy Hash: E4F0A0707060196BC601CA6DAE04B9E7B9CC70160CF800AC6B808E7F10F7A2CE3443C9

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5FD20 Relevance: 6.3, APIs: 4, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48bf725274e0261ce0c8dcf76a79c6e84b064b59e03fc5adf4287a391d1d870
Instruction ID: 82fecdca7f061b9b96656e4aa0b85b398e51c303ec5dbb6ec16e51ac11872da4
Opcode Fuzzy Hash: b48bf725274e0261ce0c8dcf76a79c6e84b064b59e03fc5adf4287a391d1d870
Instruction Fuzzy Hash: 51C1D175D04209DFCB04CF98C580ADEB7B5FF49318F648259D815BBB50E731AA26CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7CEA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6CC7CEDC
__isleadbyte_l.LIBCMT ref: 6CC7CF10
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 6CC7CF41
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 6CC7CFAF

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 632b5e338378e772f9ad12ce7969f6420bc45b74ea9c4b8ab195af52f287ef83
Instruction ID: 5107868cee0383bf40dace50358fe3ff45516d98b665b06518b76f877eba738d
Opcode Fuzzy Hash: 632b5e338378e772f9ad12ce7969f6420bc45b74ea9c4b8ab195af52f287ef83
Instruction Fuzzy Hash: 7031D631A05247EFDB21EF64C841AAE7BB5FF02315F2445A9F4609B590F731D950DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CC60F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,B4419C60,00000000,?,?,00000000,00000000,00000000), ref: 6CC60FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6CC6100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CC61033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 6CC6103F

Part of subcall function 6CC628A0: GetCurrentDirectoryW.KERNEL32(00000105,?,B4419C60,FFFFFFFF,?,00000004), ref: 6CC62994

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: 6631942947ff8116c5737405f839473abf673a41710d73c62a94c4513b9984b8
Instruction ID: dc8c4dbd8b2bc0b44e9ee6503630f2aee557e717aa40ed80845f08e4484bc802
Opcode Fuzzy Hash: 6631942947ff8116c5737405f839473abf673a41710d73c62a94c4513b9984b8
Instruction Fuzzy Hash: C621C771601204BFEF10CF59DC85FAFBBB8EB46768F104229FA15A76C0D774AE0586A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6D4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC8FC98,B4419C60,?,?,?,6CC7FB68,000000FF), ref: 6CC6D4F2
LeaveCriticalSection.KERNEL32(6CC8FC98,?,?,?,6CC7FB68,000000FF), ref: 6CC6D50A
LeaveCriticalSection.KERNEL32(6CC8FC98,?,?,?,?,6CC7FB68,000000FF), ref: 6CC6D547

Strings

[Content], xrefs: 6CC6D52D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: 821ff7f3bb9f2a69e60bac6c08e5b02486908f1e3dcd8e064068760d8dffde8b
Instruction ID: db05f0af0ce92a2bbfe63207edbbe14a3cb0334d4bc90f5bc4ec43f46a127349
Opcode Fuzzy Hash: 821ff7f3bb9f2a69e60bac6c08e5b02486908f1e3dcd8e064068760d8dffde8b
Instruction Fuzzy Hash: E801C472E05508AFD720DF59C845B9EBBF8FB0A614F90465AE802D7F80F77569048B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CC51A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6CC51A4E
ReadFile.KERNEL32(00000000), ref: 6CC51A55
GetLastError.KERNEL32 ref: 6CC51A72
GetLastError.KERNEL32 ref: 6CC51A80

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: ec5dc696516c4108049ba7dcf58c5bb352918ac809e20c82317e906c387b0afd
Instruction ID: f92d93a576d4243ede7fad30a90b989f04bf891550db08d67cfa260521bc6475
Opcode Fuzzy Hash: ec5dc696516c4108049ba7dcf58c5bb352918ac809e20c82317e906c387b0afd
Instruction Fuzzy Hash: 8F01F43730120A9BDB01DE989C04BB737BCEB45365F14863AF906CBA80E730D8B187A4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5EF70 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC5EF8A

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC5EFA4

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

std::exception::exception.LIBCMT ref: 6CC5EFC3
__CxxThrowException@8.LIBCMT ref: 6CC5EFD8

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: 16889649c80ab21a0561680a9577ab6b7a62642f300c8ccd2dd3e5768ee5e703
Instruction ID: 7032f7243f824c0442b46c8af6cbf53b7297e5bcd223c1bc19f5807d417bb87c
Opcode Fuzzy Hash: 16889649c80ab21a0561680a9577ab6b7a62642f300c8ccd2dd3e5768ee5e703
Instruction Fuzzy Hash: CCF0F6B1D052086ADB08DFF49941BEFBB399B84318F4487ADD40192E85FF75C62D82B2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC659C0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC659D3

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC659ED

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

std::exception::exception.LIBCMT ref: 6CC65A0C
__CxxThrowException@8.LIBCMT ref: 6CC65A21

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: 7d1744f20fbab7b7240cfe667ec36cf7a627450e42f3f442241f143d0c1f6404
Instruction ID: 7874c107a7b9d8df27e8ad3c576b6e2af6bd8084af0214112d2dbf4dffc50407
Opcode Fuzzy Hash: 7d1744f20fbab7b7240cfe667ec36cf7a627450e42f3f442241f143d0c1f6404
Instruction Fuzzy Hash: 9BF0F6B180520969DB14DAB58981EEFBB389B4031CF10465AD402A2D82FB70D61E8272

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5F310 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CC5F320

Part of subcall function 6CC75F2A: __FF_MSGBANNER.LIBCMT ref: 6CC75F4D
Part of subcall function 6CC75F2A: __NMSG_WRITE.LIBCMT ref: 6CC75F54
Part of subcall function 6CC75F2A: RtlAllocateHeap.NTDLL(00000000,6CC5FA6F,?,00000000,?,?,6CC54D3F,0000000C,B4419C60,?,?,00000000,?,?,6CC7EF9B,000000FF), ref: 6CC75FA1

__CxxThrowException@8.LIBCMT ref: 6CC5F33A

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

std::exception::exception.LIBCMT ref: 6CC5F359
__CxxThrowException@8.LIBCMT ref: 6CC5F36E

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID:
API String ID: 1974103008-0
Opcode ID: 907812c1d9d4f7a716572cfb1247c3d7bd953766ca115320a30244190c4d2956
Instruction ID: cafdc408f2b115f9b498cd39ed0f560dd5ff4d4671a7c0ae555965613923c49f
Opcode Fuzzy Hash: 907812c1d9d4f7a716572cfb1247c3d7bd953766ca115320a30244190c4d2956
Instruction Fuzzy Hash: C1F024B08062087ADB1CCFB5D801ADE7B68DF44358F80C61EEC1982E84FB70D32886A5

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7BE2A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CC7BE36

Part of subcall function 6CC772BB: __getptd_noexit.LIBCMT ref: 6CC772BE
Part of subcall function 6CC772BB: __amsg_exit.LIBCMT ref: 6CC772CB

__getptd.LIBCMT ref: 6CC7BE4D
__amsg_exit.LIBCMT ref: 6CC7BE5B
__lock.LIBCMT ref: 6CC7BE6B

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 934d52ef7c1c4e6d81c7ee75a753c8961c02d2b384a9434f14b413b252ab0d16
Instruction ID: 9a41e9f557c2bda0b886a865c00fe67bd591e690452da758e9faba8e6afa02c0
Opcode Fuzzy Hash: 934d52ef7c1c4e6d81c7ee75a753c8961c02d2b384a9434f14b413b252ab0d16
Instruction Fuzzy Hash: 88F09032901B06CBEB329BA48401B8E77B0EF0172CF15469AE55097F90FB345949DB72

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6FC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC6FD8E
__CxxThrowException@8.LIBCMT ref: 6CC6FDA3

Strings

-u, xrefs: 6CC6FC64

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throw
String ID: -u
API String ID: 2005118841-3343466670
Opcode ID: 0c7017dc501e275563f7bf92e48229c5243c243f690f983ba098de85a00e3170
Instruction ID: 6d41d22e96fb895e7f3121975b7c873323fbdd5c36b3f6d38a16c54bf6d3aa36
Opcode Fuzzy Hash: 0c7017dc501e275563f7bf92e48229c5243c243f690f983ba098de85a00e3170
Instruction Fuzzy Hash: 54416071D05248EFDB21CF9ACE80ACEBBB4FB05348F508956E805A7E00F7749A558BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6FDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 6CC6FE54
__CxxThrowException@8.LIBCMT ref: 6CC6FED8

Strings

-v, xrefs: 6CC6FE5D

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: Exception@8Throwwsprintf
String ID: -v
API String ID: 2898814609-1581256980
Opcode ID: 16e56adefd2769c3bebeefda27791f3881c15e460cfd2ad82f78627719a06dbf
Instruction ID: 70f3a1789101913e919f622fb057b496553cd7975a543ce89c3af4ca4defc14d
Opcode Fuzzy Hash: 16e56adefd2769c3bebeefda27791f3881c15e460cfd2ad82f78627719a06dbf
Instruction Fuzzy Hash: D1313271D01248AFCB10CFE9C984ADEFBF8EF44704F50852AE515E7B45E7759A188BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC60AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,0000005F,00000000,B4419C60,00000000), ref: 6CC60B62
__CxxThrowException@8.LIBCMT ref: 6CC60B88

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Strings

_, xrefs: 6CC60B25

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ByteCharExceptionException@8MultiRaiseThrowWide
String ID: _
API String ID: 3144726602-701932520
Opcode ID: eeec5ecf6f20f58fc363c881e4a3933c8b6b570e3adc5d09b17ff413d53ab17b
Instruction ID: 9c80100e5ccb484e7f7868ca3dc09e15b802f286f2b9bae2f08bb1120c7d8e59
Opcode Fuzzy Hash: eeec5ecf6f20f58fc363c881e4a3933c8b6b570e3adc5d09b17ff413d53ab17b
Instruction Fuzzy Hash: FA218E71504249EFDB00CF99C980F9BFBF8EF89718F14855AE9149B741E771AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC62FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6CC65DBD,?,?,6CC65C37,?,6CC65DBD,?,6CC8FCC8,00000000,00000000), ref: 6CC6300E
RegQueryValueExW.ADVAPI32(6CC65DBD,Path,00000000,6CC65DBD,?,6CC65DBD,?,6CC65DBD,?,6CC8FCC8,00000000,00000000), ref: 6CC6304E

Strings

Path, xrefs: 6CC63002, 6CC63045

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: 756be8842b2b1da10e68d523bed1dc8ad6b711ec50697d73e69c760d41b9911d
Instruction ID: 451acc4222f5deb81ae76846ff4a5fd1a407e765c0972837e943983af90ae742
Opcode Fuzzy Hash: 756be8842b2b1da10e68d523bed1dc8ad6b711ec50697d73e69c760d41b9911d
Instruction Fuzzy Hash: 4E1190B1A05604AFEB14DFA9C9C08AFFBF9FF08304B24886EE146D3A00F77099458B50

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6C8BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC6C8C2

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

GetLastError.KERNEL32(00000000,00000000), ref: 6CC6C8C7

Strings

7-Zip cannot load Mapi32.dll, xrefs: 6CC6C8D2

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ErrorExceptionException@8LastRaiseThrow
String ID: 7-Zip cannot load Mapi32.dll
API String ID: 2060628206-1691247220
Opcode ID: f39da91e392f6b300fd458b5281dafc298e570c085853b91790f46ec5e5eee12
Instruction ID: 8a5a8546fc23943c71a56941da395d7639a824325ff2b3c87960d7c9c448338f
Opcode Fuzzy Hash: f39da91e392f6b300fd458b5281dafc298e570c085853b91790f46ec5e5eee12
Instruction Fuzzy Hash: 1611A172905248EAEB10DBE4DD40BDEB7B4EF54308F54419CE50997780EB715A19CB73

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7AE09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CC769BB: __getptd.LIBCMT ref: 6CC769C1
Part of subcall function 6CC769BB: __getptd.LIBCMT ref: 6CC769D1

__getptd.LIBCMT ref: 6CC7AE18

Part of subcall function 6CC772BB: __getptd_noexit.LIBCMT ref: 6CC772BE
Part of subcall function 6CC772BB: __amsg_exit.LIBCMT ref: 6CC772CB

__getptd.LIBCMT ref: 6CC7AE26

Strings

csm, xrefs: 6CC7AE34

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction ID: 91fcb7cb0f407e4be3060bbd94a9b00f7794626f3bc14f634c9d2a8d1722d9a4
Opcode Fuzzy Hash: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction Fuzzy Hash: 74014634801609CBCB358FB1D480AADB7B5FF80319F24652ED45196EA0EB30D5A9DB71

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7E688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CC7E66F

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

std::bad_exception::bad_exception.LIBCMT ref: 6CC7E697

Part of subcall function 6CC75DCA: std::bad_exception::bad_exception.LIBCMT ref: 6CC75DD5

Strings

Access violation - no RTTI data!, xrefs: 6CC7E68F

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
String ID: Access violation - no RTTI data!
API String ID: 1432139112-2158758863
Opcode ID: 0b4493de8fa3738aa378f2973125c457093b067c22ff53aee6b6ce9420da0385
Instruction ID: 913640efd5052ef89182582f190b9a674c55fa86fbffb79bb790e5ee121507a3
Opcode Fuzzy Hash: 0b4493de8fa3738aa378f2973125c457093b067c22ff53aee6b6ce9420da0385
Instruction Fuzzy Hash: 5EE01276910508CFCF14CBA9C981ADE77B4FB19319F150854E402F7A50E734E955DF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CC7518F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CC75196
__CxxThrowException@8.LIBCMT ref: 6CC751C1

Part of subcall function 6CC7663B: RaiseException.KERNEL32(?,6CC70629,B4419C60,?,?,6CC70629,?,6CC88388,B4419C60), ref: 6CC7667D

Strings

invalid string position, xrefs: 6CC7519B

Memory Dump Source

Source File: 00000002.00000002.2620853410.000000006CC51000.00000020.00000001.01000000.00000005.sdmp, Offset: 6CC50000, based on PE: true

Associated: 00000002.00000002.2620796351.000000006CC50000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621061200.000000006CC83000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2621144850.000000006CC8D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc50000_TDService.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 9a9a10ee5e9832a31d583627241a76e1fc229767294974540bc4f1a8a0dd9857
Instruction ID: bde5062807180bda053feb2d60e8383cbc40ec3594d344c2fcf2dc6e2a975135
Opcode Fuzzy Hash: 9a9a10ee5e9832a31d583627241a76e1fc229767294974540bc4f1a8a0dd9857
Instruction Fuzzy Hash: 59D017728501089BDB10DBE4CC54FDE7738EB14328F840829A201AA980FBB4AA088A74

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TechkonDriver64Bit.exePID: 3292, Parent PID: 6352COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1921
Total number of Limit Nodes:	17

Executed Functions

Function 693CAE70 Relevance: 25.9, APIs: 2, Strings: 12, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 693D07D0: CharUpperW.USER32(?,00000000,?,693CFCF3,?,693CFE6C,?,00000000,?,00000010,ADDB68B1,?,00000000,00000000), ref: 693D07F7
Part of subcall function 693D07D0: CharUpperW.USER32(?,?,693CFE6C,?,00000000,?,00000010,ADDB68B1,?,00000000,00000000), ref: 693D0804

_memset.LIBCMT ref: 693CB3D4
VariantClear.OLEAUT32(?), ref: 693CBEEE

Strings

001, xrefs: 693CB76A
!, xrefs: 693CB89D
rar, xrefs: 693CB8F8
exe, xrefs: 693CB192
r, xrefs: 693CB899
R, xrefs: 693CB891
a, xrefs: 693CB895
iso, xrefs: 693CB996
hT?i, xrefs: 693CB3B8
udf, xrefs: 693CBA33
Unknown error, xrefs: 693CBEB2, 693CBEB7
hT?i, xrefs: 693CB77E

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CharUpper$ClearVariant_memset
String ID: !$001$R$Unknown error$a$exe$hT?i$hT?i$iso$r$rar$udf
API String ID: 2702283269-3315987462
Opcode ID: 0a10e59b28ad346079bc88471a5cea936f18fc0fe1a332dfcc60a45b6f91bbd3
Instruction ID: 2ee14429d69bd8035e6274362ef5517d876bf75e089957c22e70151dc6a8ab7a
Opcode Fuzzy Hash: 0a10e59b28ad346079bc88471a5cea936f18fc0fe1a332dfcc60a45b6f91bbd3
Instruction Fuzzy Hash: B9C24B75901668CBCB24CF68CD80BDAB7B5BF49304F1085D9E949AB350DB31AE85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 693C8AB0 Relevance: 20.3, APIs: 7, Strings: 4, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 693C8BF9
_malloc.LIBCMT ref: 693C8CB0
__CxxThrowException@8.LIBCMT ref: 693C8CCA
__CxxThrowException@8.LIBCMT ref: 693C8CE1
__CxxThrowException@8.LIBCMT ref: 693C8CF8
FindClose.KERNEL32(FFFFFFFF,?), ref: 693C8EA0
__CxxThrowException@8.LIBCMT ref: 693C997B

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

001, xrefs: 693C9003
rar, xrefs: 693C90BC
@S?i, xrefs: 693C8B27
R?i, xrefs: 693C8F05

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$CloseFind$ExceptionRaise_malloc
String ID: 001$@S?i$rar$R?i
API String ID: 231924613-643945057
Opcode ID: eaebe1e435c5ad156bb8dd008c446cb468d1459e802e0b09dbcc2fd00064c8f0
Instruction ID: 4a3e806acb7cedf9a7859fde9355b0ce0f0738bf135bad64393686fb18f84716
Opcode Fuzzy Hash: eaebe1e435c5ad156bb8dd008c446cb468d1459e802e0b09dbcc2fd00064c8f0
Instruction Fuzzy Hash: 829224B5508781DFC724CF68C980A9BBBE5BF89308F508A2EE5D987351D731E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 693D4C00 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 693D2470: FindClose.KERNEL32(?,ADDB68B1,693F0658,00000000), ref: 693D24C4
Part of subcall function 693D2470: FindFirstFileW.KERNEL32(693F50B8,?,ADDB68B1,693F0658,00000000), ref: 693D24DE
Part of subcall function 693D2470: FindFirstFileW.KERNEL32(?,?), ref: 693D253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 693D4CE0

Strings

R?i, xrefs: 693D4D27
(_?i, xrefs: 693D51F1

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: (_?i$R?i
API String ID: 2295610775-2198602348
Opcode ID: ee679da534b2fa2bcd1afe0f4e7f60a6aca5936e4c1d86a8dafe0e76f4146fcd
Instruction ID: d534dc09d6f1afc120ac9cb66bf03e208add06ae7326aae65757913c89f09818
Opcode Fuzzy Hash: ee679da534b2fa2bcd1afe0f4e7f60a6aca5936e4c1d86a8dafe0e76f4146fcd
Instruction Fuzzy Hash: 323248B65083809FD720CF68C490A9BB7E4FFC9314F148A2EE5D997390D771A949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 693E2A30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 693E2B0E
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 693E2B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 693E2B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 693E2B48
FindResourceW.KERNEL32(693C0000,00000068,RC_DATA), ref: 693E2B7E
LoadLibraryW.KERNEL32(?,?), ref: 693E2BA7

Strings

7z.dll, xrefs: 693E2AAC
RC_DATA, xrefs: 693E2B76

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource_memset
String ID: 7z.dll$RC_DATA
API String ID: 597928718-3209790242
Opcode ID: 86a6db81dcd022d9af2e67bd4d1c0d4799c02fd8ddde75badfea6387cbe3235e
Instruction ID: 43a41a99193889795c017e77a63d11e97c459a1c681804c3d6b07939d975770e
Opcode Fuzzy Hash: 86a6db81dcd022d9af2e67bd4d1c0d4799c02fd8ddde75badfea6387cbe3235e
Instruction Fuzzy Hash: 9341C27A5083519BCB00DF64D984B5FB7ECBB89748F004A1AF99693280DB35D809CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 693D35F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 693D37C4
GetLastError.KERNEL32(?), ref: 693D37D1

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: 8f3cb833901af1eb4e3008481284ce95b9671556a34f9439b87ae534798fa123
Instruction ID: 9bec47c6d84ff4c3ed8b77fdf416ffeb8579a0616e884609c8317c01b1a4e02f
Opcode Fuzzy Hash: 8f3cb833901af1eb4e3008481284ce95b9671556a34f9439b87ae534798fa123
Instruction Fuzzy Hash: AD8280766083419FD724CF24C890B9BB7E5BF89318F10891DE99997390D771EC49CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 693D2470 Relevance: 4.6, APIs: 3, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,ADDB68B1,693F0658,00000000), ref: 693D24C4
FindFirstFileW.KERNEL32(693F50B8,?,ADDB68B1,693F0658,00000000), ref: 693D24DE
FindFirstFileW.KERNEL32(?,?), ref: 693D253A

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: be7b9e5b561b75e2e33498ac232bd03b546d7e90b6fdad07b3f3aef548a9d04d
Instruction ID: fdd83d092855fc4a6872a476f851cbdfb08a906ffb4e9d19289f6a46c6faae27
Opcode Fuzzy Hash: be7b9e5b561b75e2e33498ac232bd03b546d7e90b6fdad07b3f3aef548a9d04d
Instruction Fuzzy Hash: C73152765087429FCB10DF24D955B5BB7E8FF49364F104B19E8A5D3280E731A90ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 10001B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction ID: d3e97598432a4a316c69c7b199a975740681d618dafaa63f0622d860b7c48d59
Opcode Fuzzy Hash: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction Fuzzy Hash: A9C09B7490431D97DB00E7E5D9C9D8EB7FCB608204F500451E555F3141E670F94587A1

Uniqueness

Uniqueness Score: -1.00%

Function 693D82B0 Relevance: 53.3, APIs: 28, Strings: 2, Instructions: 779
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 693D84B2
__CxxThrowException@8.LIBCMT ref: 693D8687
__CxxThrowException@8.LIBCMT ref: 693D86ED
__CxxThrowException@8.LIBCMT ref: 693D8708
__CxxThrowException@8.LIBCMT ref: 693D8723
__CxxThrowException@8.LIBCMT ref: 693D874D
__CxxThrowException@8.LIBCMT ref: 693D882F
__CxxThrowException@8.LIBCMT ref: 693D8A68
__CxxThrowException@8.LIBCMT ref: 693D8A83
__CxxThrowException@8.LIBCMT ref: 693D8A9E
__CxxThrowException@8.LIBCMT ref: 693D8AF2
__CxxThrowException@8.LIBCMT ref: 693D8324

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693D8390
_malloc.LIBCMT ref: 693D83B1
__CxxThrowException@8.LIBCMT ref: 693D83CB
__CxxThrowException@8.LIBCMT ref: 693D8416
__CxxThrowException@8.LIBCMT ref: 693D8468
__CxxThrowException@8.LIBCMT ref: 693D8CE4
__CxxThrowException@8.LIBCMT ref: 693D8CF9
__CxxThrowException@8.LIBCMT ref: 693D8D14

Strings

7zCon.sfx, xrefs: 693D84F2
(_?i, xrefs: 693D8525

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: (_?i$7zCon.sfx
API String ID: 1305767944-2890817312
Opcode ID: d4a946df5d6f502544d6a19dad300cfe23f01463650b5f2aa03fd2ba8a9a201e
Instruction ID: 8ae995cadbc4ae6c221060e45029c59f68a634ff09948560cd67741d138dcf75
Opcode Fuzzy Hash: d4a946df5d6f502544d6a19dad300cfe23f01463650b5f2aa03fd2ba8a9a201e
Instruction Fuzzy Hash: 1D62BF76D00258DFDF21CBA4C990BDEB7B8AF48308F1495D9D189A7240DB71AB89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10004859 Relevance: 30.7, APIs: 16, Strings: 1, Instructions: 904COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000485E

Part of subcall function 100081EF: __EH_prolog.LIBCMT ref: 100081F4

Part of subcall function 10017690: InitializeCriticalSection.KERNEL32 ref: 100176BE

DeleteCriticalSection.KERNEL32(?), ref: 10004A99
SysFreeString.OLEAUT32(?), ref: 10004D73
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004E67
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004ED2
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004F2E
DeleteCriticalSection.KERNEL32(?), ref: 10005080
DeleteCriticalSection.KERNEL32(?), ref: 100050D7
DeleteCriticalSection.KERNEL32(?), ref: 10005131
DeleteCriticalSection.KERNEL32(?), ref: 1000519C
SysFreeString.OLEAUT32(?), ref: 100051C5
DeleteCriticalSection.KERNEL32(?), ref: 10005201
SysFreeString.OLEAUT32(?), ref: 10005238
DeleteCriticalSection.KERNEL32(?), ref: 10005274
DeleteCriticalSection.KERNEL32(?), ref: 100052EC
DeleteCriticalSection.KERNEL32(?), ref: 1000537C

Strings

*, xrefs: 100053D3

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$Delete$FreeString$H_prolog$Initialize
String ID: *
API String ID: 3004459923-163128923
Opcode ID: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
Instruction ID: ecb8a8915c69c7c96d6c908040f4422d87eeaffb21051c4ea884642e96cadca4
Opcode Fuzzy Hash: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
Instruction Fuzzy Hash: C3926B74900289DFEF04CFA4C884ADDBBB5FF19344F21849CE446AB256CB71AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 693C42E0 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 693C2670: __CxxThrowException@8.LIBCMT ref: 693C2688

Part of subcall function 693C4D10: _malloc.LIBCMT ref: 693C4D3A
Part of subcall function 693C4D10: __CxxThrowException@8.LIBCMT ref: 693C4D54

__CxxThrowException@8.LIBCMT ref: 693C46C2

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693C4855
__CxxThrowException@8.LIBCMT ref: 693C4876
CharUpperW.USER32(?), ref: 693C4943

Strings

Incorrect command line, xrefs: 693C431B, 693C433E, 693C454F, 693C4579, 693C48F9
Cannot use absolute pathnames for this command, xrefs: 693C4521
lP?i, xrefs: 693C484D
(_?i, xrefs: 693C42F8

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$CharExceptionRaiseUpper_malloc
String ID: (_?i$Cannot use absolute pathnames for this command$Incorrect command line$lP?i
API String ID: 2609558216-2253862469
Opcode ID: 232f81f4f9b09cee3a7c2a639e1f4c82d5c24dd8ef97f5531f1dca61bc3c45ef
Instruction ID: db0959dcb9ba6a22e2e8a30af3e34b88df72e2cc5f9c5b5fa2926b9109909a77
Opcode Fuzzy Hash: 232f81f4f9b09cee3a7c2a639e1f4c82d5c24dd8ef97f5531f1dca61bc3c45ef
Instruction Fuzzy Hash: 82228D75508B80DBD711CF24C588B9ABBE5BF85308F04899DE4D94B292C772ED49CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 693D6530 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 323
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(693D6AD8,GetHandlerProperty2), ref: 693D6584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 693D6595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 693D65B1

Strings

GetHandlerProperty, xrefs: 693D658F
GetHandlerProperty2, xrefs: 693D6579
hT?i, xrefs: 693D687A
GetNumberOfFormats, xrefs: 693D65AB

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats$hT?i
API String ID: 190572456-2050740644
Opcode ID: e4baad617c6baad553e3eab7576c7664fd706ff8c098de52344417bd71716d51
Instruction ID: 467a57f28c5f3d225d592ed8508ab3f7902193986800a05a9ed7f8320b11027e
Opcode Fuzzy Hash: e4baad617c6baad553e3eab7576c7664fd706ff8c098de52344417bd71716d51
Instruction Fuzzy Hash: 09D15DB6D00218DFDB14DFA4CD90B9EB7B9BF48308F1081AED569A7241DB319A49CF61

Uniqueness

Uniqueness Score: -1.00%

Function 693E3EF0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-p, xrefs: 693E42F4
!, xrefs: 693E4375
7za L , xrefs: 693E3F2F
-i, xrefs: 693E3FF8, 693E4110
-x, xrefs: 693E41BA, 693E4256

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID: -i$ -p$ -x$!$7za L
API String ID: 0-2873427068
Opcode ID: 58cedc4ed1584cace0e0de16c1170bbb8dc3fb01be3349b644b7b6ed76986dab
Instruction ID: aa28366e58f671e8cb56f57da4f802d233f75d25efcf33b76e01476c5491aa4e
Opcode Fuzzy Hash: 58cedc4ed1584cace0e0de16c1170bbb8dc3fb01be3349b644b7b6ed76986dab
Instruction Fuzzy Hash: E8F1B476D00258EBCF04DBE4CD84BDEBBB8AF58308F10C55AE545BB201DB75AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693CC2D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 693CC32F

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

_malloc.LIBCMT ref: 693CC313

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

_malloc.LIBCMT ref: 693CC353
__CxxThrowException@8.LIBCMT ref: 693CC36F
GetLastError.KERNEL32(693F4C28,80000000,00000001,00000003), ref: 693CC3BC

Strings

(L?i, xrefs: 693CC388
(L?i, xrefs: 693CC3D7, 693CC3E0

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw_malloc$AllocateErrorExceptionHeapLastRaise
String ID: (L?i$(L?i
API String ID: 2571202727-2486559215
Opcode ID: 5dcd0ce43d1b9081668ddb9a0dcd2d5c539c36dfe7dd1b3e6b3b99c3f08df670
Instruction ID: f8a1443fea7b06e7d01f65e08c376912dad15e358a98c17c587d3d681980ef0c
Opcode Fuzzy Hash: 5dcd0ce43d1b9081668ddb9a0dcd2d5c539c36dfe7dd1b3e6b3b99c3f08df670
Instruction Fuzzy Hash: C741C375600605EFCB10CFA8C980B9BB7F8FF49310F108659E95597380D775AD06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A421 Relevance: 9.1, APIs: 6, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,10019FC1,1001A015,?,?,?), ref: 1001A4AE
HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction ID: 1c740d521b0f7e213dbb02f6402200852ca7cbed31c7f2444751ff5461a08e8a
Opcode Fuzzy Hash: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction Fuzzy Hash: 5A110035240365BBE661EB10DCCAF05B7A6E785750F314026FA456A571C7B2BCA2CB14

Uniqueness

Uniqueness Score: -1.00%

Function 693D69E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,ADDB68B1,693FFCC8,00000000), ref: 693D6A18
FreeLibrary.KERNEL32(00000000), ref: 693D6A38
FreeLibrary.KERNEL32(00000000,ADDB68B1,693FFCC8,00000000), ref: 693D6A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 693D6AA5

Strings

CreateObject, xrefs: 693D6A9D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: 15ddb94665670d0e33da9a0f426d552a9ebfdd5ef47514fc3deb04ab4a9db890
Instruction ID: 5d429fcb7a630746419634b3562b96ae4dfea9cf4f1db761450eeb534ae5ef7b
Opcode Fuzzy Hash: 15ddb94665670d0e33da9a0f426d552a9ebfdd5ef47514fc3deb04ab4a9db890
Instruction Fuzzy Hash: AA417BB6A00606AFEB00CF65D994AAEBBF9FF49314F10C51AE8658B380D735E904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 693C3E70 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 693C4042

Part of subcall function 693C4D10: _malloc.LIBCMT ref: 693C4D3A
Part of subcall function 693C4D10: __CxxThrowException@8.LIBCMT ref: 693C4D54

__CxxThrowException@8.LIBCMT ref: 693C41B5

Strings

P?i, xrefs: 693C3F2A
P?i, xrefs: 693C409D, 693C40A0

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: P?i$P?i
API String ID: 175252994-3409997002
Opcode ID: 4518a332558de117574d6144e8aaeb87c6bbc4d2acd32809348e557fbea8a0a7
Instruction ID: c4c31a2d07fc559326e0311241e0cebc1d1f812231d5ff0ff4dc025a6d5dc0c8
Opcode Fuzzy Hash: 4518a332558de117574d6144e8aaeb87c6bbc4d2acd32809348e557fbea8a0a7
Instruction Fuzzy Hash: 8DB115B5C01269DFDB10CF99D984ADEFBB4BF08304F6081AEE559A7240D7346A45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 693C8670 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 693C8916
__CxxThrowException@8.LIBCMT ref: 693C892C

Strings

<H, xrefs: 693C896F

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorException@8LastThrow
String ID: <H
API String ID: 1006195485-4022674625
Opcode ID: c00963d173594dc7d2da73c783877dc777e795abbcc7be01a901234fdbd829af
Instruction ID: 330355751ef78a6906accae899ec01afa4ca2dc1f9aa98d07a90351c5a9ce8f9
Opcode Fuzzy Hash: c00963d173594dc7d2da73c783877dc777e795abbcc7be01a901234fdbd829af
Instruction Fuzzy Hash: 39E180B6D00649EFCF04DFE8C980AEEBBB5BF49314F148159E555AB240D731AE05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 693CCAE0 Relevance: 4.8, APIs: 3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 693CCB18

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693CCB30

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Part of subcall function 693CA910: __CxxThrowException@8.LIBCMT ref: 693CA992

GetLastError.KERNEL32(?,00000000,00000000), ref: 693CCBD3

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$AllocateErrorExceptionHeapLastRaise_malloc
String ID:
API String ID: 214124409-0
Opcode ID: cd68e20f4a797f1de1a03d13063a82d25d3116a47205fb62bdfafd7a7543d451
Instruction ID: d08f5e904b4ec0c9a87cdfe7d6c05452c75ab727f8c37e11442c0812644aa230
Opcode Fuzzy Hash: cd68e20f4a797f1de1a03d13063a82d25d3116a47205fb62bdfafd7a7543d451
Instruction Fuzzy Hash: C6A171B5D00218EFCF04DFA8D980ADEB7B4BF48318F10862AE955A7341D735AE15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693D2A70 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,ADDB68B1,?,00000000,?,?,00000000,?,?,?,00000000,693F0C38,000000FF), ref: 693D2A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,ADDB68B1,?,00000000,?,?,00000000), ref: 693D2ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 693D2B2B

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 50b686eaebd77a21e45d61da4d08e198798e4f83824f27da218b61588355d666
Instruction ID: 9d3211112f931a096434e07b454db42649eb667416f7ee6c14e49ebd301899b9
Opcode Fuzzy Hash: 50b686eaebd77a21e45d61da4d08e198798e4f83824f27da218b61588355d666
Instruction Fuzzy Hash: 4331B17690021AAFDB00CF54DD45BAFBBB8FB05760F10831AF825972C0D771AA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693D1340 Relevance: 4.6, APIs: 3, Instructions: 86COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,ADDB68B1,?,?,?,?,?,00000000), ref: 693D136E
GetLastError.KERNEL32 ref: 693D138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 693D13D7

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: e8077f90fc74ebddbd4e98acc75e8c68ab6e46de128c9124725880f7e37a44c1
Instruction ID: 9594ef36aca2bd297efcb66984796429b2f39cbd04865b14c770513819b36d62
Opcode Fuzzy Hash: e8077f90fc74ebddbd4e98acc75e8c68ab6e46de128c9124725880f7e37a44c1
Instruction Fuzzy Hash: 3721DE77E04214ABDF00CF99E8057AFBBB8FB45665F10016BED19A3680DB366909C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 693C1AB0 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 693C1AEC
GetLastError.KERNEL32 ref: 693C1B01

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 95613dc544146c35a539308c68f71874bab09f39969bd8c52cdaa2cacfc7b6e0
Instruction ID: ab76f904b6599a5bde68980179617ae2edc22a31685865fb3bfc07e0e31f469d
Opcode Fuzzy Hash: 95613dc544146c35a539308c68f71874bab09f39969bd8c52cdaa2cacfc7b6e0
Instruction Fuzzy Hash: 3811D67770550A8F8700CEACE9419AAB7D8EB85361F10826EFD19C7250E733D815ABF2

Uniqueness

Uniqueness Score: -1.00%

Function 693D0880 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693D08A5

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693D08CD
__CxxThrowException@8.LIBCMT ref: 693D08F7

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: e28f33f81907103d816e2e164a2ca9581120d8d07ef2090519af7fab6257251d
Instruction ID: a40a02d1708d97d14dc6a4f25f1f995c128f5c9f383f57e458464fa6f9dd4d5a
Opcode Fuzzy Hash: e28f33f81907103d816e2e164a2ca9581120d8d07ef2090519af7fab6257251d
Instruction Fuzzy Hash: 6D110ABA700B049FD718DFA5CAA0C1FB3E9AB98704B50CD2DD54AD3211E771FA094761

Uniqueness

Uniqueness Score: -1.00%

Function 10002805 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000280A
EnterCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000281B
LeaveCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000284F

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction ID: a3f251eb98acb8aeedd518acfd2e06878d0524bbd79d22e0378b99734f5e22aa
Opcode Fuzzy Hash: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction Fuzzy Hash: D401467AA00214AFDB11CF94C848B9ABBB9FF48711F10841AFD01A7221C7B4A9119B60

Uniqueness

Uniqueness Score: -1.00%

Function 100087AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100087B3

Strings

, xrefs: 1000887A

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
Instruction ID: dc996c4eb68a87c8f199726ed84f9ce0c47e74a02a5fa25993d790b30f922306
Opcode Fuzzy Hash: 87f4fbd9ed9835f185afa277318771e429ef2e1cba041ba48d785ab7c3d46741
Instruction Fuzzy Hash: B4515275E002069FEB14DFA8C881ABEB7F5FF88380F548529E545E7245DB70AE41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 693C1950 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 693C196C

Strings

(L?i, xrefs: 693C195C

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: (L?i
API String ID: 2591292051-1374871465
Opcode ID: 049115ba798545fa869dc34521b8a3189e599eb1b8e522b34301aeb23645707b
Instruction ID: 4704eb1c6e863d64835894bdd42f76ca9133ebfe9a8e94cd90dea75bf0e09b12
Opcode Fuzzy Hash: 049115ba798545fa869dc34521b8a3189e599eb1b8e522b34301aeb23645707b
Instruction Fuzzy Hash: 73E02076100B1097D7105FA89808B4BBBCCAF01370B10C719E5B9C72E0D371D841C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 693D1060 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,ADDB68B1,?,00000000,?,?,00000000,?,ADDB68B1,00000000), ref: 693D108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 693D10ED

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2b2745979fcf8d9df037d664ae98c81743a83334ba613f289eba3bbd868ab0a7
Instruction ID: dd41c29e139ffe1eb828c0035a6edddf994be8c8faeae81126e1046f308039de
Opcode Fuzzy Hash: 2b2745979fcf8d9df037d664ae98c81743a83334ba613f289eba3bbd868ab0a7
Instruction Fuzzy Hash: 4321A477E042489BDF00CF94E805B9EFBB8FB45665F10416BE919D3340EB36AA09C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 693D7860 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693D788A

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693D78A4

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: 4a49c3075339b278ba8c4388c5982281fcdb52592b654ce74b34df49895f3743
Instruction ID: 41426ae97bf6ab0f835479dfa5d70f10080d9aebbd99de4147c794fc9144563f
Opcode Fuzzy Hash: 4a49c3075339b278ba8c4388c5982281fcdb52592b654ce74b34df49895f3743
Instruction Fuzzy Hash: 6B11E1B6904605EFCB14CF54C891B9AB7E9FB45314F00862EE86AC7790E731AE08CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10019CB8 Relevance: 3.0, APIs: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction ID: 578384fe474d0b562f95e97df9c8fae57dcf2a9e42d60c7228f8a9f52e2ea293
Opcode Fuzzy Hash: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction Fuzzy Hash: 77F028372043156BDB21DF65EC05DAF3BA5DF446B0B104029FA18CA190CB31D8918B91

Uniqueness

Uniqueness Score: -1.00%

Function 693C1C20 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 693C1C4C
GetLastError.KERNEL32 ref: 693C1C75

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: bb479ca81f7d9cb661439c9bab038d4b5fb49eac8366c4434cfe852117d54e9c
Instruction ID: 9f16cc2073039e93fccb4e7c31bd6723ccb0ef38cde12f35cfc8575153067216
Opcode Fuzzy Hash: bb479ca81f7d9cb661439c9bab038d4b5fb49eac8366c4434cfe852117d54e9c
Instruction Fuzzy Hash: 4501867620070ADFD710CE98D880BAB37ECBF44711F00882AF916CB580D7BAEC509BA1

Uniqueness

Uniqueness Score: -1.00%

Function 693C19C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 693C19EB
GetLastError.KERNEL32 ref: 693C1A0C

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 8f1db5aa0deb25e97a66421c0f8fbe72b6425320c053dbb51227dd0c6f644d1a
Instruction ID: 233188f0ca5506b6e2d7070db063f64b73720af7efe3718939ee9d1ec7181422
Opcode Fuzzy Hash: 8f1db5aa0deb25e97a66421c0f8fbe72b6425320c053dbb51227dd0c6f644d1a
Instruction Fuzzy Hash: 2AF0627635024ADBDB04CE94E854B6B33ADBB84310F10C42AF95ACB280D776DC60EB62

Uniqueness

Uniqueness Score: -1.00%

Function 1001A3C4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5

Part of subcall function 1001A27C: GetVersionExA.KERNEL32 ref: 1001A29B

HeapDestroy.KERNEL32 ref: 1001A414

Part of subcall function 1001A4C9: HeapAlloc.KERNEL32(00000000,00000140,1001A3FD,000003F8), ref: 1001A4D6

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction ID: f49a4552e00520ddd5bd994c2c6f56530b3037705a70c7491d35245aff95e9ec
Opcode Fuzzy Hash: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction Fuzzy Hash: 80F09274611302ABFF14EB309D8AB5935D1DB86791F308436F905CD0A6EBF0D8D2A611

Uniqueness

Uniqueness Score: -1.00%

Function 693C1BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,693DB356,?,?,?,?,?,?,693F5380,?), ref: 693C1BE9
GetLastError.KERNEL32(?,?,?,?,?,?,693F5380,?), ref: 693C1BFD

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 9759c95fae820225bb5e32df27929e151102e6d3f7f90273e70bc790e1d2d78c
Instruction ID: 0230724b50066546036386cb1fbfd2ae87cc24598c2e9fd89de53d3e6d9ac649
Opcode Fuzzy Hash: 9759c95fae820225bb5e32df27929e151102e6d3f7f90273e70bc790e1d2d78c
Instruction Fuzzy Hash: 52E01279350E039ADB104AB9CC4432675D87B017727A0CB28E076C54E0EB2EC8419A05

Uniqueness

Uniqueness Score: -1.00%

Function 693D09E0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693D09E8

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693D0A02

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID:
API String ID: 2732643326-0
Opcode ID: c77945cb92c53e5413daf3fdac7118d55abecd3125a5130a1d2e4ff911e2f915
Instruction ID: 1667a62ee21d282963dc059522fe69dd85dfcf5966e8bf8e959a1ef91d5e8190
Opcode Fuzzy Hash: c77945cb92c53e5413daf3fdac7118d55abecd3125a5130a1d2e4ff911e2f915
Instruction Fuzzy Hash: D5D0A795C5D30C738E04C7A5AD0199E77EC8D55308F404195FC4D83101FA22E61E42A6

Uniqueness

Uniqueness Score: -1.00%

Function 10005AA5 Relevance: 2.1, APIs: 1, Instructions: 563COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10005AAA

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 418329258124bf81065b2b4d57c61a1207f38c192b65861c8e98dbda376bc648
Instruction ID: 24b6dd137383e7686c229cdd86bb12439a3ed7e02ed9f8727553bb3e51178dae
Opcode Fuzzy Hash: 418329258124bf81065b2b4d57c61a1207f38c192b65861c8e98dbda376bc648
Instruction Fuzzy Hash: 37427F74904249DFEB00CFA4C984BDDBBF5EF09384F244099E849AB386DB75AE45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10009824 Relevance: 2.0, APIs: 1, Instructions: 502COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10009829

Part of subcall function 1000940A: __EH_prolog.LIBCMT ref: 1000940F

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction ID: 7486e4567ea8ddc6047f59b84a49b8006f4fb568e8041e622ffbf8bfe16b7337
Opcode Fuzzy Hash: 20f936d777ea9103e340114ca1ee5d19f73f9782134bda5456cca3b6a12e0127
Instruction Fuzzy Hash: FE326A74904249DFEB14CFA4C880BDEBBB5FF45384F50806EE44AA7296DB70AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1000A0CE Relevance: 1.8, APIs: 1, Instructions: 315COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1fdb5b8ec1110f418a073286f027cb5b8f34d3fd1367757d92b8a8bddb269a89
Instruction ID: 16904ee073535d8266284e3ab4d1ee50d97a619b8a40ccf019ff2181d9a9fe66
Opcode Fuzzy Hash: 1fdb5b8ec1110f418a073286f027cb5b8f34d3fd1367757d92b8a8bddb269a89
Instruction Fuzzy Hash: 4DC17F74A0024ADFEB14CFA8C884BDEBBF1FF49380F204629E445A7245DB75AE81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 693C7350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,ADDB68B1,?,?,?,?,?,693F0300,000000FF), ref: 693C7438

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 46481ee16b7bcde7346aee33bff39b732d0a7c617b4315124aa91c87749b6402
Instruction ID: 0d09fdddd2a5b1abc9c1530260066f76ef6138721b49d5b8df5f19a84d4b9f64
Opcode Fuzzy Hash: 46481ee16b7bcde7346aee33bff39b732d0a7c617b4315124aa91c87749b6402
Instruction Fuzzy Hash: 81515FB6A04A82FFD708CF75C480B9AFBA4FB49314F00865AD86A87601D732BC54DB91

Uniqueness

Uniqueness Score: -1.00%

Function 10008DDD Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10008DE2

Part of subcall function 1000A51C: __EH_prolog.LIBCMT ref: 1000A521

Part of subcall function 1000809D: __EH_prolog.LIBCMT ref: 100080A2

Part of subcall function 10008A65: __EH_prolog.LIBCMT ref: 10008A6A

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction ID: 0609df34ebabf0a4a76e2918ca157b4269ad3ae51d55b8a1eb59a52bcf34417c
Opcode Fuzzy Hash: 0f2ef54e4d54980d6866c9ca524e59761326e1e766cc54546d6848b3260f56d2
Instruction Fuzzy Hash: DF51B274D00159DBEF14DFA4C885AEEBBB2FF44390F108159E8556B286CB71AF41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000790D Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10007912

Part of subcall function 1000A496: __EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 10007AD6: __EH_prolog.LIBCMT ref: 10007ADB

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction ID: b40d17a970ea470072cc094887da7a6dca03317504114bf01e9f4a1a4d97d151
Opcode Fuzzy Hash: 6bb2def5445f3f3c03a7c343a9c0ad1c6318bdf414d74d1a9ec3108368a0102b
Instruction Fuzzy Hash: 71516D34900249DFEB11CFA4C954AEDBBB4FF95344F244099E845A7246DB74AF01DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1000670B Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006710

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction ID: 1deedfb3ed3693e114189d5c8674f5dba158b51214873baba276ba9a2bcc193c
Opcode Fuzzy Hash: ef6ed3350f196110724b134d7ae58aa8eb2fad54a812ca61983dfb10647da9bd
Instruction Fuzzy Hash: 73419F74900246CFDB24CF58C88496ABBF2FF48358B2546ADD0999B351C731ED46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001BB7 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 02f82e7474b5bf284dc11ca32c5ed9bea93bcca5a0ad974320cd45ec439b4ff6
Instruction ID: 59f6696383dde50044605197c7a13ccbc641f9314ce92faebeca66c50bce22a2
Opcode Fuzzy Hash: 02f82e7474b5bf284dc11ca32c5ed9bea93bcca5a0ad974320cd45ec439b4ff6
Instruction Fuzzy Hash: 47219F7198468ADBFB24CF60D9808EEB7B6EB412D0B21852DE49267648D730FE41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100188B8 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1001899F

Part of subcall function 1001A13A: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10018A6D,00000009,?,?,?), ref: 1001A177
Part of subcall function 1001A13A: EnterCriticalSection.KERNEL32(?,?,?,10018A6D,00000009,?,?,?), ref: 1001A192

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction ID: bde266228d008e092059639ff97bb6b14f601e90ad82446575358dbeed7d10ff
Opcode Fuzzy Hash: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction Fuzzy Hash: C5219032A00255BAEB10DB68DC42BADB7A4FB01764F284215F924EF1C0C774EBC18B52

Uniqueness

Uniqueness Score: -1.00%

Function 693CA910 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 693D25A0: FindClose.KERNEL32(FFFFFFFF,?,ADDB68B1,?,00000000,693F50B8,?,693F0438,000000FF,?,693D265E), ref: 693D25EA

__CxxThrowException@8.LIBCMT ref: 693CA992

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseExceptionException@8FindRaiseThrow
String ID:
API String ID: 2665002293-0
Opcode ID: 22d134c5d8dddc09ebea1216c3453f13984afe4331ae3d62bb9d68558ab28a1c
Instruction ID: 16d3b6196e6ec23fd29948970a7d226cc532dd764e00fcb34bc9120a5190feb6
Opcode Fuzzy Hash: 22d134c5d8dddc09ebea1216c3453f13984afe4331ae3d62bb9d68558ab28a1c
Instruction Fuzzy Hash: 2D1193B6500704ABCB10CF69D880E9BF7F8FF55314F00861EE99683350DB35A9098B90

Uniqueness

Uniqueness Score: -1.00%

Function 10001BB2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ebc697b0815d610cf069836f75e5a55b253691f45cf9441c62c129786d474608
Instruction ID: c4781e215bb38ec63fc671d50aeec44c86b20336711f2647e792547350c1aef8
Opcode Fuzzy Hash: ebc697b0815d610cf069836f75e5a55b253691f45cf9441c62c129786d474608
Instruction Fuzzy Hash: 3911E232A4124A9FFB14CF64C9808EEB3F2EB403D0B21813DE052A7648D730FE428B90

Uniqueness

Uniqueness Score: -1.00%

Function 693D1420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(693C890F,ADDB68B1,?,?,00000000), ref: 693D1528

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 732e40941995936e9eec27052e0b4ed31215810a2485f1650754dc25e55912cd
Instruction ID: e088418d582c9095daa41640fc002e258bddb2fc19e848114a51bf5d2c30b467
Opcode Fuzzy Hash: 732e40941995936e9eec27052e0b4ed31215810a2485f1650754dc25e55912cd
Instruction Fuzzy Hash: C9B1C577E00219DBCF08CFE8D991AEEB7B5FF44344F14816AD845A7250E736A909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100030FD Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10003102

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction ID: 1a273919c2d2e3c34155be655625f51d11ef425e7a56d82b9c8decfb09a307f8
Opcode Fuzzy Hash: b051d9f97361328a0859d23c7aef542bc19b666e6010b629010daeab35dc1547
Instruction Fuzzy Hash: 4011CE71A44155ABE722CF29CC05B9F37A9EF0A7E4F008119F805DB265DB31DD01C790

Uniqueness

Uniqueness Score: -1.00%

Function 100039C8 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100039CD

Part of subcall function 10003600: __EH_prolog.LIBCMT ref: 10003605

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction ID: a8771e25a5af01616f041783a1a562797f3037f43c5b4569f99eca130688d05b
Opcode Fuzzy Hash: 257c9c1ad85ce65f22fa997ad81c770c6af4072d1a7d7a18d6b680d099e47f4b
Instruction Fuzzy Hash: 44118274E01795DAEB09DBA8C9153EEFBEADF95300F54414D9057A7282CBF42B04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10006A20 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006A25

Part of subcall function 10001B41: GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prologInfoSystem
String ID:
API String ID: 3096475795-0
Opcode ID: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction ID: 655e083bcbb9f064a1fc17e82f19a2947c3b56c2b4f5fa8eba001858af0e0911
Opcode Fuzzy Hash: 52262b521e3cf9d1fda4bec855af299aea3512d706ab6bf0f58a7f0b292b1210
Instruction Fuzzy Hash: 8701A2B0901B949FD320CF59D48469AFBE5FB09300F90886EE4AA9B612C7B8A6448F50

Uniqueness

Uniqueness Score: -1.00%

Function 693D25A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 693D2470: FindClose.KERNEL32(?,ADDB68B1,693F0658,00000000), ref: 693D24C4
Part of subcall function 693D2470: FindFirstFileW.KERNEL32(693F50B8,?,ADDB68B1,693F0658,00000000), ref: 693D24DE
Part of subcall function 693D2470: FindFirstFileW.KERNEL32(?,?), ref: 693D253A

FindClose.KERNEL32(FFFFFFFF,?,ADDB68B1,?,00000000,693F50B8,?,693F0438,000000FF,?,693D265E), ref: 693D25EA

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c1db16749b3c24ed1869a874ec2ef5607ee7375092b6562a602b1bbb3f177a94
Instruction ID: 2b13f9e4b6e08654a0730ecdcc4e848cb9bc30242b728a7b8555081c3f6f331d
Opcode Fuzzy Hash: c1db16749b3c24ed1869a874ec2ef5607ee7375092b6562a602b1bbb3f177a94
Instruction Fuzzy Hash: 20F0F9B6944649AFC700CF98D844BAEB7BCFB06724F50472AF831936C0D73569098A64

Uniqueness

Uniqueness Score: -1.00%

Function 10001C8A Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction ID: 5875ca03f24213d4aa71392faa60c1249694dc7a06dd944ad61b31c616a183da
Opcode Fuzzy Hash: 45d6ff788914fcc1d4c4362c08418d30e3fc6f4cbe7bfcd3fb78a9b9f7420235
Instruction Fuzzy Hash: 3AF03432A00219ABEB05CF98CC01BEEB7B9EB44365F108659B821E7290C775EE00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10001C8F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001C8F

Part of subcall function 10001BB2: __EH_prolog.LIBCMT ref: 10001BB7

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction ID: a1ce7e251bf4dddfe6d8e665bceb41a424ebb3d89783d3dba666d18c8877da87
Opcode Fuzzy Hash: a6999b822fc1317c87866c67a3b2559ab8b1b0de13d547d74b0740a9a50685af
Instruction Fuzzy Hash: 43F0F876A00219EBEB15CF94CC05BEEB7B9FB44365F108659B825E7290C775AA10CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000A51C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A521

Part of subcall function 1000A6CF: __EH_prolog.LIBCMT ref: 1000A6D4

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1d350eab279bd1dbb4d5681b811c8a6e671b98ab2be674e428506e08396ece6a
Instruction ID: aa797ba4b590ef7c1940b9b2a0b5883bf8ddeea9a52a955fbfb363e5e3090a9b
Opcode Fuzzy Hash: 1d350eab279bd1dbb4d5681b811c8a6e671b98ab2be674e428506e08396ece6a
Instruction Fuzzy Hash: 72E09275A00514AFEB08DBA88C066AE76E5EB48250F00862EA012E62D0DFB06A808754

Uniqueness

Uniqueness Score: -1.00%

Function 10006B51 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10006B56

Part of subcall function 10006B9E: __EH_prolog.LIBCMT ref: 10006BA3

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction ID: 8d9a37c6723f40ac26746b696ab844ca15524eaf609cb6dee056dacbd79d311a
Opcode Fuzzy Hash: c2b4014cf6554101de5823dbb260c55468e89f1724bea5b528826ce213b76a0a
Instruction Fuzzy Hash: 8BF08C71C01A60DBD724CF54C8057DEB7B4EF08310F10464EA8A6A7281CBB0BA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000A496 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000A49B

Part of subcall function 1000A0CE: __EH_prolog.LIBCMT ref: 1000A0D3

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction ID: 889d54ac72d292b4943fb779c3a4a2c7d1dd2e9b7142568b78a9c6437da24382
Opcode Fuzzy Hash: 49073b19b42d1aece4de8f7d12bddb7de673f44c594ea106af3184a1002e2511
Instruction Fuzzy Hash: 12E08C36900148FBDF02CF84C805FEF7B75EB452A0F00851AF40415051C3BAAA50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10019DDE Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction ID: 587474e3f6e270900c506b7264c4806e64e6eaefbf2122b89b9aa41b5ebd9e7a
Opcode Fuzzy Hash: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction Fuzzy Hash: D6E08C3694052AABEB12E7A0CC46A9E37A0EF08380F040010F8005E062DB70FED24692

Uniqueness

Uniqueness Score: -1.00%

Function 693E93E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,693E6375,00000001,?,?,?,693E64EE,?,?,?,693F7F18,0000000C,693E65A9), ref: 693E93F6

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 857b88342d5d9fc04a4ed5948582af9c9b39775bce7da672a267a3adabcaba2e
Instruction ID: 989a8bd63ac9e957fe9cb8030eaee9fc31f95612a14472f0c01fa60f2d5a2500
Opcode Fuzzy Hash: 857b88342d5d9fc04a4ed5948582af9c9b39775bce7da672a267a3adabcaba2e
Instruction Fuzzy Hash: 85D05E325943885BDB00AEB4AD09B263BDCA786395F008436F82CC6144E670C540D601

Uniqueness

Uniqueness Score: -1.00%

Function 1000AB8D Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000AB92

Part of subcall function 10006A20: __EH_prolog.LIBCMT ref: 10006A25

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 50b908e3d647e52a03bcd4fae9ea66269edd5c88d27c4c7adeab43c7193a34f8
Instruction ID: f583651af7419ed68212601d7f78bfec3ebd47bcdcb2918c529af6d70d782719
Opcode Fuzzy Hash: 50b908e3d647e52a03bcd4fae9ea66269edd5c88d27c4c7adeab43c7193a34f8
Instruction Fuzzy Hash: 1AD05E75F14141AFEB08DBB4981636D76E2EB48280F10856DA012E66C1DFB0BA80C625

Uniqueness

Uniqueness Score: -1.00%

Function 10019DE9 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction ID: 55bdce0fba70f3b5ff24939f3ea0e7f6c7887ef7bde984f872fb15fca6cc6046
Opcode Fuzzy Hash: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction Fuzzy Hash: 4FD05E31540626ABE213E770DC86A5E2394DF05790B110115F8408D062DF70FEC24192

Uniqueness

Uniqueness Score: -1.00%

Function 1001C000 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A125
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A12D
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A135

TlsFree.KERNEL32(FFFFFFFF,10019FBC,1001A015,?,?,?), ref: 1001C010

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalDeleteSection$Free
String ID:
API String ID: 1584690612-0
Opcode ID: 3aaa27bac5001039f89fed55244ff3c97aaca533f641e9855337a23d41bd91ec
Instruction ID: 546efeec3206eed097d6fb3f9723a3f69e2227c44c0d9f166d3baed5ab6dace6
Opcode Fuzzy Hash: 3aaa27bac5001039f89fed55244ff3c97aaca533f641e9855337a23d41bd91ec
Instruction Fuzzy Hash: 97C04C74501715CAF511D7388CCA9083695F7493707F41744F1BAC60F5D774D8C38A00

Uniqueness

Uniqueness Score: -1.00%

Function 10017570 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 10019CB8: CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
Part of subcall function 10019CB8: GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

GetLastError.KERNEL32 ref: 10017598

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction ID: 5da84cd6a30c0b06f2c1d8553272c344b363e72c39abfbd7409f2c23709d4e44
Opcode Fuzzy Hash: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction Fuzzy Hash: 2EE0ECB2254252AEF304DB648C46FA776E9EB94B81F50442DBA49CA180E6B0D944C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 10012A20 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10001E62,?,?,1000B459,?), ref: 10012A31

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction ID: 499c3da3a26d341c9e988975342de67c6826636d0b386d7712dafe969d9ecfde
Opcode Fuzzy Hash: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction Fuzzy Hash: 18B012F07B238176FE6E87204C5BF662451A740BC7F601098F301DC0C4E7E094409015

Uniqueness

Uniqueness Score: -1.00%

Function 10012A40 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,10001E7E,?,10001E58,?,?,1000B459,?), ref: 10012A4C

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction ID: 32e2f69f7c2909d2d391187de9ef312e1eea697864ad2fb4147c7fa98b3e1f25
Opcode Fuzzy Hash: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction Fuzzy Hash: 96B012B034230023FD78C3110D45B1611506B00741E60405C73016C4C08570E4018504

Uniqueness

Uniqueness Score: -1.00%

Function 0045D350 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2603832442.000000000045D000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_45d000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3617e82bd60fd03c4f87f95ed51040e3e5dadaeb0a3bebd0a62139b9ab93b5fc
Instruction ID: 9da881a1668667c5f5e61f0e74ea972f87722d8f5ad42a96f98ef7bce5f6fe0a
Opcode Fuzzy Hash: 3617e82bd60fd03c4f87f95ed51040e3e5dadaeb0a3bebd0a62139b9ab93b5fc
Instruction Fuzzy Hash: B301C4B17442046BCB12EB98DC42FAB3798EB09315F108116FE04D7292DA7DD8858BBD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D404 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2603832442.000000000045D000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_45d000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b760d498d9366e2b8c008b5068de0d1edf9298eee5e882ad9278cafc15f1fbe1
Instruction ID: 9eb0517791e028c6019ed048d3cd8418304ffda763c1f22c3199e77c15fb86ab
Opcode Fuzzy Hash: b760d498d9366e2b8c008b5068de0d1edf9298eee5e882ad9278cafc15f1fbe1
Instruction Fuzzy Hash: 9BC0026160663466562535A92CC5CEF01488D462AEB24136BBD209A293DAAD4DC542EE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 693DE950 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693DE9AF

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

(<i, xrefs: 693DECA6, 693DEB8F
xS?i, xrefs: 693DEA15
(<i, xrefs: 693DEC97, 693DE9A4, 693DE9A7
Empty file path, xrefs: 693DE9A8

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: (<i$ (<i$Empty file path$xS?i
API String ID: 3976011213-2125799869
Opcode ID: 259c57b57fc6da0a8bb1bce478b4ce47e390d06e4f294f7dbf8e9f89bea3fcaf
Instruction ID: ee761c9a88879ca39b1083d2bd6f1f19a814e61061bf353c4d6b3de7ea348a70
Opcode Fuzzy Hash: 259c57b57fc6da0a8bb1bce478b4ce47e390d06e4f294f7dbf8e9f89bea3fcaf
Instruction Fuzzy Hash: 3EC1A076D002599FDF14CFA8C990AEEFBB5BF48304F148059E946A7340D771AA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 693E51C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 693E6B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 693E6BA6
UnhandledExceptionFilter.KERNEL32(693F3328), ref: 693E6BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 693E6BCD
TerminateProcess.KERNEL32(00000000), ref: 693E6BD4

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d78f9ca32e8eb0491adacfb9c676f4516c6e009423ae66a92845cdc1c48abdb1
Instruction ID: 71123aa76522c754fa329609d821048d6de7029e033a0b1c6933823fa7cac1d3
Opcode Fuzzy Hash: d78f9ca32e8eb0491adacfb9c676f4516c6e009423ae66a92845cdc1c48abdb1
Instruction Fuzzy Hash: E021CFB9800285DFDF00DF69F589A883BBCFB0A359F50801AED2987391E7B55985EF05

Uniqueness

Uniqueness Score: -1.00%

Function 693CD1B0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693CD3E1

Strings

@]<i, xrefs: 693CD559, 693CD55C
pT?i, xrefs: 693CD466

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw
String ID: @]<i$pT?i
API String ID: 2005118841-4009442558
Opcode ID: c666e11c7af08b7377e59d557c77c08e4af332b1df1b72ebfd645aba3989cc77
Instruction ID: 9b529066aa839e6dd2dd612b95c10bd933d0df8ae42ea3b4587327d7d4e3a02c
Opcode Fuzzy Hash: c666e11c7af08b7377e59d557c77c08e4af332b1df1b72ebfd645aba3989cc77
Instruction Fuzzy Hash: 90D16BB5D00649DBCB00DFA8C9806AEF7B5FF48314F24812AE529EB250D771AD46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 693C2AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 693C2BB4
GetLastError.KERNEL32 ref: 693C2BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 693C2BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 693C2C88
CloseHandle.KERNEL32(?), ref: 693C2C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 693C2CA8
GetLastError.KERNEL32 ref: 693C2CBD
SetEvent.KERNEL32(00000000), ref: 693C2CC4
GetLastError.KERNEL32 ref: 693C2CCE
CloseHandle.KERNEL32(00000000), ref: 693C2CD5
GetLastError.KERNEL32 ref: 693C2CDF

Part of subcall function 693C2670: __CxxThrowException@8.LIBCMT ref: 693C2688

Strings

Incorrect mapping data, xrefs: 693C2C02
MapViewOfFile error, xrefs: 693C2BEE
Incorrect command line, xrefs: 693C2B13, 693C2B63
data error, xrefs: 693C2C6A
Can not open mapping, xrefs: 693C2BCD

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$Exception@8MappingThrowUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 682782048-464465891
Opcode ID: e742f10465325c89fb5b50e1305491af1e0cd0723891fe45f3a856dcac39665c
Instruction ID: 9229be1d13146a54b7269e96607e4d9b2bba6b3d22db9e5e1e6e9d00e34b05c2
Opcode Fuzzy Hash: e742f10465325c89fb5b50e1305491af1e0cd0723891fe45f3a856dcac39665c
Instruction Fuzzy Hash: 0F61077AA00A09DBDF00DFA8CE44B9EB7B8EF05755F109025E955A7240DB71ED02C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 693E715B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,693F7F58,0000000C,693E7296,00000000,00000000,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B), ref: 693E716D
__crt_waiting_on_module_handle.LIBCMT ref: 693E7178

Part of subcall function 693E7790: Sleep.KERNEL32(000003E8,?,?,693E70BE,KERNEL32.DLL,?,693E94A4,?,693E5FE3,693CFA7E,?,?,693C4D3F,0000000C,ADDB68B1,?), ref: 693E779C
Part of subcall function 693E7790: GetModuleHandleW.KERNEL32(693CFA7E,?,693E70BE,KERNEL32.DLL,?,693E94A4,?,693E5FE3,693CFA7E,?,?,693C4D3F,0000000C,ADDB68B1,?,?), ref: 693E77A5

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 693E71A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 693E71B1
__lock.LIBCMT ref: 693E71D3
InterlockedIncrement.KERNEL32(02C08302), ref: 693E71E0
__lock.LIBCMT ref: 693E71F4
___addlocaleref.LIBCMT ref: 693E7212

Strings

DecodePointer, xrefs: 693E71A9
EncodePointer, xrefs: 693E7195
9?i, xrefs: 693E7184
KERNEL32.DLL, xrefs: 693E7167, 693E716C, 693E7177

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$9?i
API String ID: 1028249917-3254198565
Opcode ID: c19f077451b6a52c57bcbc80020ca01b52e5eed162c0351c09d6cda292549657
Instruction ID: 47f328d30ee7b926e788b301b2100f6cffde5657f21e235ea4d155cec17de751
Opcode Fuzzy Hash: c19f077451b6a52c57bcbc80020ca01b52e5eed162c0351c09d6cda292549657
Instruction Fuzzy Hash: FE11AC75805712EAD720DF79D904B5EBBF4AF01318F10841BE4AA97390CB34AA41CF66

Uniqueness

Uniqueness Score: -1.00%

Function 693E0680 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

Part of subcall function 693E1230: _malloc.LIBCMT ref: 693E1258
Part of subcall function 693E1230: __CxxThrowException@8.LIBCMT ref: 693E1272

__CxxThrowException@8.LIBCMT ref: 693E0704

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8324
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8390
Part of subcall function 693D82B0: _malloc.LIBCMT ref: 693D83B1
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D83CB
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8416

Part of subcall function 693E5FF4: __lock.LIBCMT ref: 693E6012
Part of subcall function 693E5FF4: ___sbh_find_block.LIBCMT ref: 693E601D
Part of subcall function 693E5FF4: ___sbh_free_block.LIBCMT ref: 693E602C
Part of subcall function 693E5FF4: HeapFree.KERNEL32(00000000,693CFA7E,693F7EB0,0000000C,693E81B5,00000000,693F8028,0000000C,693E81EF,693CFA7E,?,?,693EC6AB,00000004,693F82E8,0000000C), ref: 693E605C
Part of subcall function 693E5FF4: GetLastError.KERNEL32(?,693EC6AB,00000004,693F82E8,0000000C,693E7669,693CFA7E,?,00000000,00000000,00000000,?,693E726D,00000001,00000214), ref: 693E606D

__CxxThrowException@8.LIBCMT ref: 693E0A37

Strings

-sfx, xrefs: 693E0723
7za , xrefs: 693E06D6
-mhe, xrefs: 693E08F0
-w, xrefs: 693E077E
-ssw, xrefs: 693E0736

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$_malloc$ErrorExceptionFreeHeapLastRaise___sbh_find_block___sbh_free_block__lock
String ID: -mhe$ -sfx$ -ssw$ -w$7za
API String ID: 1499254937-429077366
Opcode ID: a94745bcd1d71786a224671c755d4f892479beea0b411f1b1c8486ad1e1b6042
Instruction ID: 2b119ba8c2dac7105cf54b1ae7f323f08dc0b712679b657592ab897203937741
Opcode Fuzzy Hash: a94745bcd1d71786a224671c755d4f892479beea0b411f1b1c8486ad1e1b6042
Instruction Fuzzy Hash: 2EC1A57A800258DBDF04DBE4CD84BDEB7B8BF14308F14C559D945AB241D7B5EA08DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001D844 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1001CEDA,?,Microsoft Visual C++ Runtime Library,00012010,?,10021594,?,100215E4,?,?,?,Runtime Error!Program: ), ref: 1001D856
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1001D86E
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1001D87F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1001D88C

Strings

MessageBoxA, xrefs: 1001D868
user32.dll, xrefs: 1001D851
GetActiveWindow, xrefs: 1001D879
GetLastActivePopup, xrefs: 1001D881

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction ID: 0f002242f215f962b8815e3b350398d74b100aa23eb915cf8c40db05b23b1dbb
Opcode Fuzzy Hash: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction Fuzzy Hash: A9014431604221AFE750FFF59CC4AAA7BE9EB59194721043BF604C6121DF35C8829B70

Uniqueness

Uniqueness Score: -1.00%

Function 1001DD3D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10021660,00000001,00000000,00000000,7591E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DD7F
LCMapStringA.KERNEL32(00000000,00000100,1002165C,00000001,00000000,00000000,?,?,1001DA1F,?), ref: 1001DD9B
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,7591E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DDE4
MultiByteToWideChar.KERNEL32(?,1002CE51,00000000,00000001,00000000,00000000,7591E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DE1C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1001DE74
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1001DE8A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1001DEBD
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1001DF25

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction ID: 295e34877b95ddc79519c14bcd414cd7068b9c5c0158a783dd3936514e77c558
Opcode Fuzzy Hash: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction Fuzzy Hash: FB517B31400259ABDF22EF94CD85ADE3FF9FB59751F20411AF910A9160C732DDA1EB60

Uniqueness

Uniqueness Score: -1.00%

Function 693CFD20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 294COMMON

Download Yara Rule

Strings

hU?i, xrefs: 693D0040, 693D0043
x?i, xrefs: 693CFDB2
|U?i, xrefs: 693D00A5

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID: hU?i$x?i$|U?i
API String ID: 0-1316874357
Opcode ID: c6713d8c6242fd90092abb596fdf53ac66abdb48ada9093032d4977e45ca1be6
Instruction ID: a857408b41d00ac16f8615cbc5a318ee33579bc47c0f228a69d21353eb051386
Opcode Fuzzy Hash: c6713d8c6242fd90092abb596fdf53ac66abdb48ada9093032d4977e45ca1be6
Instruction Fuzzy Hash: BAC192B6D04619DFCB04CF98D980ADEB7B5FF49314F20811AE865AB350D731AE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001CDB6 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 1001CE23
GetStdHandle.KERNEL32(000000F4,10021594,00000000,?,00000000,?), ref: 1001CEF9
WriteFile.KERNEL32(00000000), ref: 1001CF00

Strings

Microsoft Visual C++ Runtime Library, xrefs: 1001CECF
..., xrefs: 1001CE75
Runtime Error!Program: , xrefs: 1001CE89
<program name unknown>, xrefs: 1001CE33

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction ID: d8c9acc08caec27d87d178c777f48a963db8df66c36a8e0edad6fccd900c7ff8
Opcode Fuzzy Hash: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction Fuzzy Hash: 4131C476A0022CAFEB11EAA0CD85FDE77BDFB45344F6001A6F945DA041E770EAC5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CC4B Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CC66
GetEnvironmentStrings.KERNEL32(?,?,?,?,10019F70), ref: 1001CC7A
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CCA6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10019F70), ref: 1001CCDE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10019F70), ref: 1001CD00
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10019F70), ref: 1001CD19
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CD2C
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1001CD6A

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction ID: 10dabb665d0db05ed410ab17b42963db07fe2840a9ab64d8aea903b972c4df90
Opcode Fuzzy Hash: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction Fuzzy Hash: 7331A6B25043AE5FE311EBB8ACC5D2A7ADDEB4A1D4B220639F545CB111EA31DCC187A1

Uniqueness

Uniqueness Score: -1.00%

Function 693E02B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 271COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693E060F
__CxxThrowException@8.LIBCMT ref: 693E0329

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693E0624

Strings

7za , xrefs: 693E02F6
(_?i, xrefs: 693E05BE
-an, xrefs: 693E0569

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: -an$(_?i$7za
API String ID: 3476068407-2629992683
Opcode ID: 176022262642c5f531b30cffff8be3a74791d22a2f37e141bcf4db74a2fc3c4c
Instruction ID: ea03c4df7125faf42306d127e7a8b414cdbf93121d9a3ae2e531e5299129e242
Opcode Fuzzy Hash: 176022262642c5f531b30cffff8be3a74791d22a2f37e141bcf4db74a2fc3c4c
Instruction Fuzzy Hash: 28B1847A804148EBDF01DFE8D980BCEBBB4AF14308F148055E945BB241DB75FA49DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 693E0AA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693E0C28
__CxxThrowException@8.LIBCMT ref: 693E0C42
__CxxThrowException@8.LIBCMT ref: 693E0D3F

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693E0D54

Strings

7za l, xrefs: 693E0AE6
-an, xrefs: 693E0BF4

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_malloc
String ID: -an$7za l
API String ID: 1305767944-193614407
Opcode ID: b2303362d5a156d81d5ad0f21fef9538af2f6f42c8e570c874220d124a4e19a2
Instruction ID: d6fae1674fcf4dc0bba2fcda3e6ccd8d2fdfb0eae3abb47b8f5a158b318fab96
Opcode Fuzzy Hash: b2303362d5a156d81d5ad0f21fef9538af2f6f42c8e570c874220d124a4e19a2
Instruction Fuzzy Hash: B7919379904258DFCF00DFA8C990BDEBBB8AF54308F148059E845AB241DB71BA49DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693E2980 Relevance: 10.6, APIs: 7, Instructions: 74fileCOMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(693C0000,00000000,693C0000,?,?,693E2B94,?), ref: 693E2993
SizeofResource.KERNEL32(693C0000,00000000), ref: 693E29A1
LockResource.KERNEL32(00000000), ref: 693E29AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 693E29CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 693E29E5
CloseHandle.KERNEL32(00000000), ref: 693E29FA
DeleteFileW.KERNEL32(00000000), ref: 693E2A0A

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileResource$CloseCreateDeleteHandleLoadLockSizeofWrite
String ID:
API String ID: 406028064-0
Opcode ID: 79b3bc89fdafc4139dc2ef8e42e74b023f1c06f721a085d9c1dcb33a9d5f0447
Instruction ID: 7f28cd7e9831e298e89e51c21c8b06715b882a1970015cf37f9ada6d5a828701
Opcode Fuzzy Hash: 79b3bc89fdafc4139dc2ef8e42e74b023f1c06f721a085d9c1dcb33a9d5f0447
Instruction Fuzzy Hash: EF113F727412567BD71086689C48F9FB77CEB46661F004167FD52E7280DA72C802C372

Uniqueness

Uniqueness Score: -1.00%

Function 693EE5CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBCMT ref: 693EE624

Part of subcall function 693EE370: PMDtoOffset.LIBCMT ref: 693EE400

FindVITargetTypeInstance.LIBCMT ref: 693EE62B
PMDtoOffset.LIBCMT ref: 693EE63B
std::bad_exception::bad_exception.LIBCMT ref: 693EE661
__CxxThrowException@8.LIBCMT ref: 693EE66F

Strings

Bad dynamic_cast!, xrefs: 693EE659

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 3308565544-2956939130
Opcode ID: e43620099b3c62e339e99c451cd1d6892d5e3f7770b938860446d58edb62978e
Instruction ID: 1f7caef90b007762827d28c4c21d992d92995f43d3824d5e1d75f0754e07e4c4
Opcode Fuzzy Hash: e43620099b3c62e339e99c451cd1d6892d5e3f7770b938860446d58edb62978e
Instruction Fuzzy Hash: E311E236A003249FCF20DFB8C941ABE77B4AF48355F04805BE451E7290EB35D9028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 693DF5A0 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 48COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693DF621

Strings

-aot, xrefs: 693DF5FF
-aou, xrefs: 693DF5ED
-aos, xrefs: 693DF5DB
-aoa, xrefs: 693DF5C9
-r0, xrefs: 693DF66F

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw
String ID: -aoa$ -aos$ -aot$ -aou$ -r0
API String ID: 2005118841-2704224164
Opcode ID: 68687feb07c0fb4748d2fd8931b35ea2dc57088b0a1a24220ccfeac5fcbe0b86
Instruction ID: fecadbf1d2396a4828027156a9b278384d4edf5a8671a72f9899e1fdc18df063
Opcode Fuzzy Hash: 68687feb07c0fb4748d2fd8931b35ea2dc57088b0a1a24220ccfeac5fcbe0b86
Instruction Fuzzy Hash: D9F0622972A81CA38510DA9DBC4456D73AC874595AF40C5C6F80DCB700CB67CE1613CB

Uniqueness

Uniqueness Score: -1.00%

Function 693D0450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 693D2A70: CloseHandle.KERNEL32(?,ADDB68B1,?,00000000,?,?,00000000,?,?,?,00000000,693F0C38,000000FF), ref: 693D2A9F
Part of subcall function 693D2A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,ADDB68B1,?,00000000,?,?,00000000), ref: 693D2ACC
Part of subcall function 693D2A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 693D2B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,ADDB68B1,?,?,00000000,?,?,?,00000000,693F0C38,000000FF), ref: 693D04A7
GetLastError.KERNEL32(?,?,?,00000000,693F0C38,000000FF), ref: 693D04B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,ADDB68B1,?,?,00000000,?,?,?,00000000,693F0C38,000000FF), ref: 693D051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,693F0C38,000000FF), ref: 693D053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,693F0C38,000000FF), ref: 693D056C

Part of subcall function 693D0A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,ADDB68B1,00000000), ref: 693D0AA7
Part of subcall function 693D0A20: __CxxThrowException@8.LIBCMT ref: 693D0AC1

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 693D06D8

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorException@8LastMultiSizeThrowWide
String ID:
API String ID: 1518168698-0
Opcode ID: 554376a4ca2a370d9014f6b2b19b0099b4ef92bd9e27baed809f549d952b5803
Instruction ID: cdd2f719187987d4a0f9102410d3651e673c1483ff45a2bcaacdfff6f1e079f7
Opcode Fuzzy Hash: 554376a4ca2a370d9014f6b2b19b0099b4ef92bd9e27baed809f549d952b5803
Instruction Fuzzy Hash: 9E81A177E042189BCF00DFA4D854BDEB7B5FF45764F10861AE861B7280EB359909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693E2CE0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

-ir-!, xrefs: 693E2FAB
-p, xrefs: 693E2E33
-r, xrefs: 693E2DD2
7za A , xrefs: 693E2D17

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw_malloc
String ID: -ir-!$ -p$ -r$7za A
API String ID: 3476970888-2239425251
Opcode ID: f8582a60ada3ef5e069dc8fb12d302d0d1b88554d7bde553b33b351ae2c3cf92
Instruction ID: 123be1072cbd94503464d8d9c1b1b709162ad6112b26be2767bf40f18af84f5f
Opcode Fuzzy Hash: f8582a60ada3ef5e069dc8fb12d302d0d1b88554d7bde553b33b351ae2c3cf92
Instruction Fuzzy Hash: 7502B37AD00268DBDF10DBE4C984BDEB7B4BF54308F14C19AE885A7241D771AE45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001DF8C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10021660,00000001,?,7591E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001DFCB
GetStringTypeA.KERNEL32(00000000,00000001,1002165C,00000001,?,?,?,1001DA1F,?), ref: 1001DFE5
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,7591E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E019
MultiByteToWideChar.KERNEL32(?,1002CE51,?,00000000,00000000,00000000,7591E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E051
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1001E0A7
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1001E0B9

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction ID: 73f36e6d74bf66f6ce57e3c8a420cabe8a1af6d8c6052cc8844ff2d98f481940
Opcode Fuzzy Hash: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction Fuzzy Hash: 0041577250029AAFDB21DF94CC85EDE7BBAEB09790F20052AFA119A150C735DDD1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 693EACE3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 693EAD0B

Part of subcall function 693E6968: __getptd.LIBCMT ref: 693E6976
Part of subcall function 693E6968: __getptd.LIBCMT ref: 693E6984

__getptd.LIBCMT ref: 693EAD15

Part of subcall function 693E72BB: __getptd_noexit.LIBCMT ref: 693E72BE
Part of subcall function 693E72BB: __amsg_exit.LIBCMT ref: 693E72CB

__getptd.LIBCMT ref: 693EAD23
__getptd.LIBCMT ref: 693EAD31
__getptd.LIBCMT ref: 693EAD3C
_CallCatchBlock2.LIBCMT ref: 693EAD62

Part of subcall function 693E6A0D: __CallSettingFrame@12.LIBCMT ref: 693E6A59

Part of subcall function 693EAE09: __getptd.LIBCMT ref: 693EAE18
Part of subcall function 693EAE09: __getptd.LIBCMT ref: 693EAE26

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 40114be305c3dcef8f1d0d8a4d72c4f6fe60507dae14a67093f0363fb11f4e65
Instruction ID: 7bab680d6445fbe3639d6349ce7c5a2e44fe9092fdcfa99206b4be9d1271e69d
Opcode Fuzzy Hash: 40114be305c3dcef8f1d0d8a4d72c4f6fe60507dae14a67093f0363fb11f4e65
Instruction Fuzzy Hash: 0211D4B5C01619DFDF00DFA4C988BAE7BB0FF08318F10D06AE855A7251DB399A119F61

Uniqueness

Uniqueness Score: -1.00%

Function 693E0DB0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693E109D

Part of subcall function 693DF640: __CxxThrowException@8.LIBCMT ref: 693DF66A

Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8324
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8390
Part of subcall function 693D82B0: _malloc.LIBCMT ref: 693D83B1
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D83CB
Part of subcall function 693D82B0: __CxxThrowException@8.LIBCMT ref: 693D8416

Strings

D_?i, xrefs: 693E104C
7za d, xrefs: 693E0DF6
-mhe, xrefs: 693E0F69
-w, xrefs: 693E0E18

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$_malloc
String ID: -mhe$ -w$7za d$D_?i
API String ID: 175252994-525280907
Opcode ID: 0083bf4cd0c477303198b0034ce986c3877027400fa00398c28c72e52eedff5b
Instruction ID: 173ffa5ce5cc66985b33682885e105e3be902b5e3bc88388da45634fa2ac6d99
Opcode Fuzzy Hash: 0083bf4cd0c477303198b0034ce986c3877027400fa00398c28c72e52eedff5b
Instruction Fuzzy Hash: 1D918379D00248EBDF00DBE4C984BCEBBB8AF14308F188559D945A7241DB75BE49DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001A27C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 1001A29B
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1001A2D0
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001A330

Strings

__MSVCRT_HEAP_SELECT, xrefs: 1001A2CB
__GLOBAL_HEAP_SELECTED, xrefs: 1001A30A

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction ID: ff41b7170f7c9f9639ed0085cf635e38180a7bd29c628196ad01e98acd5c5e28
Opcode Fuzzy Hash: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction Fuzzy Hash: DB310575C412986EEB61D6745C81BDD37E9DB17344F2400EAF195DE042E631DFC99B20

Uniqueness

Uniqueness Score: -1.00%

Function 693CEF70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693CEF8A

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693CEFA4

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

std::exception::exception.LIBCMT ref: 693CEFC3
__CxxThrowException@8.LIBCMT ref: 693CEFD8

Strings

d2?i, xrefs: 693CEFD1

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2?i
API String ID: 1974103008-3730799990
Opcode ID: e1b63aa0a915d56413ee7215cd83b82bb73a6adaea6df786c936cd2b57d77b5f
Instruction ID: 3e4475a4df150d4a9a4ce788f64a353f3e0d9200bc646a0b90fa849ac9342ed8
Opcode Fuzzy Hash: e1b63aa0a915d56413ee7215cd83b82bb73a6adaea6df786c936cd2b57d77b5f
Instruction Fuzzy Hash: BDF0F6B4D153086ADB0CDFF4D941BEFB7399BD4304F40C2AAD44291144EB749B1A8262

Uniqueness

Uniqueness Score: -1.00%

Function 693D59C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693D59D3

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693D59ED

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

std::exception::exception.LIBCMT ref: 693D5A0C
__CxxThrowException@8.LIBCMT ref: 693D5A21

Strings

d2?i, xrefs: 693D5A1A

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2?i
API String ID: 1974103008-3730799990
Opcode ID: d7837d5f39c070667468016df3f1c14b8658c7cd9ba243b6821a0e358423bff2
Instruction ID: d292dabe333f5508c1e35d478b73fcf864fa470377cc74fae75b81ba7c320b69
Opcode Fuzzy Hash: d7837d5f39c070667468016df3f1c14b8658c7cd9ba243b6821a0e358423bff2
Instruction Fuzzy Hash: 2CF02BB9C1421965DF08DAF48951BEFB7399F90318F00425AD442E2084EB70971E8362

Uniqueness

Uniqueness Score: -1.00%

Function 693CF310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693CF320

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693CF33A

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

std::exception::exception.LIBCMT ref: 693CF359
__CxxThrowException@8.LIBCMT ref: 693CF36E

Strings

d2?i, xrefs: 693CF367

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$AllocateExceptionHeapRaise_mallocstd::exception::exception
String ID: d2?i
API String ID: 1974103008-3730799990
Opcode ID: bbae07c298acc67504434c0dea658b16e1bb7bbabc5ceef8b2ef92e14b99eeb4
Instruction ID: 6c8b6c74aea3738548f316cc3bce58e5dce5b7f831e7595f9a1de9093477b526
Opcode Fuzzy Hash: bbae07c298acc67504434c0dea658b16e1bb7bbabc5ceef8b2ef92e14b99eeb4
Instruction Fuzzy Hash: E7F024B4814208BACF0CDFB4D901A9E77689F80344F40C21AEC5A86084FB70E7498692

Uniqueness

Uniqueness Score: -1.00%

Function 693EAA32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 693EAA4C

Part of subcall function 693E72BB: __getptd_noexit.LIBCMT ref: 693E72BE
Part of subcall function 693E72BB: __amsg_exit.LIBCMT ref: 693E72CB

__getptd.LIBCMT ref: 693EAA5D
__getptd.LIBCMT ref: 693EAA6B

Strings

csm, xrefs: 693EAA45
MOC, xrefs: 693EAA3E

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction ID: d5e5eb02659a1573a59cbeb40e1fc624dcd58494d35ef094f7f09c89ff94df09
Opcode Fuzzy Hash: 66512fbb1fdfae65ddc3ab14898e2b81321cc8c81d018f826881ec3a7f1cfdf2
Instruction Fuzzy Hash: 60E08C3A5102248FC700DB64C149B6A33B4FF4A329F5650A3F48DCB223C736E8449AA3

Uniqueness

Uniqueness Score: -1.00%

Function 1001C735 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 1001C793
GetFileType.KERNEL32(00000480), ref: 1001C83E
GetStdHandle.KERNEL32(-000000F6), ref: 1001C8A1
GetFileType.KERNEL32(00000000), ref: 1001C8AF
SetHandleCount.KERNEL32 ref: 1001C8E6

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction ID: 9e0b50c6418c78b4ce1b27a1f486aee3850f1a3a2b75f6582e04b96d90fbb996
Opcode Fuzzy Hash: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction Fuzzy Hash: 0C51243190436A8FE710DB68C8C4F697BE0EB05768F354669D5A29F2E2DB30DC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 100010A6 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

CharUpperW.USER32 ref: 100010C1
GetLastError.KERNEL32 ref: 100010CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000), ref: 100010E8
CharUpperA.USER32(?), ref: 10001101
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 10001114

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction ID: 5dd45f2d0006c2546d84b721a00360ca66f9a592c23ae8bd0920251664c2bfef
Opcode Fuzzy Hash: 8383e40484a713360037c6af6127c53484664dbcfb1822a6f6cfd995dd4f40d0
Instruction Fuzzy Hash: 210156B68002697BFB15EBE09CC9EDFB6ADEB082D4F110551FA42D3101E2B45D448770

Uniqueness

Uniqueness Score: -1.00%

Function 693EC0C6 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 693EC0D2

Part of subcall function 693E72BB: __getptd_noexit.LIBCMT ref: 693E72BE
Part of subcall function 693E72BB: __amsg_exit.LIBCMT ref: 693E72CB

__amsg_exit.LIBCMT ref: 693EC0F2
__lock.LIBCMT ref: 693EC102
InterlockedDecrement.KERNEL32(?), ref: 693EC11F
InterlockedIncrement.KERNEL32(02841668), ref: 693EC14A

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 9e048b1bffcbfa95da6d8b7ba6f6909ea17b7ab1088057240623648bb554157f
Instruction ID: 9b40f2794f83ba8dc586a5b72fd083e3175e6dcf3ea182153c42e080f80583a5
Opcode Fuzzy Hash: 9e048b1bffcbfa95da6d8b7ba6f6909ea17b7ab1088057240623648bb554157f
Instruction Fuzzy Hash: 6101B13A906B31EBDF11DF69944974E7B64BF05714F11810BE870A7780CB35A941DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 693E5FF4 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 693E6012

Part of subcall function 693E81D4: __mtinitlocknum.LIBCMT ref: 693E81EA
Part of subcall function 693E81D4: __amsg_exit.LIBCMT ref: 693E81F6
Part of subcall function 693E81D4: EnterCriticalSection.KERNEL32(?,?,?,693EC6AB,00000004,693F82E8,0000000C,693E7669,693CFA7E,?,00000000,00000000,00000000,?,693E726D,00000001), ref: 693E81FE

___sbh_find_block.LIBCMT ref: 693E601D
___sbh_free_block.LIBCMT ref: 693E602C
HeapFree.KERNEL32(00000000,693CFA7E,693F7EB0,0000000C,693E81B5,00000000,693F8028,0000000C,693E81EF,693CFA7E,?,?,693EC6AB,00000004,693F82E8,0000000C), ref: 693E605C
GetLastError.KERNEL32(?,693EC6AB,00000004,693F82E8,0000000C,693E7669,693CFA7E,?,00000000,00000000,00000000,?,693E726D,00000001,00000214), ref: 693E606D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: e35fb1c6db763ea907c76f2d58dc3b4e30384664422d3c1e3ba5e2350317ec72
Instruction ID: 9150373a7f425c3008a9a94fed17bc5807c7fa31c09ceed7cf03c0a5b347169c
Opcode Fuzzy Hash: e35fb1c6db763ea907c76f2d58dc3b4e30384664422d3c1e3ba5e2350317ec72
Instruction Fuzzy Hash: F2016275C09271EADF24AB70A909B4E3B78AF0136CF10900BF651A71C8CB359D41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1001C031 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,1001C473,1001D0D7,00000000,?,?,00000000,00000001), ref: 1001C033
TlsGetValue.KERNEL32 ref: 1001C041
SetLastError.KERNEL32(00000000), ref: 1001C08D

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

TlsSetValue.KERNEL32(00000000), ref: 1001C065
GetCurrentThreadId.KERNEL32 ref: 1001C076

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction ID: c7b26c2ea065f329baa6dbda2ade13875997561f4633f5fb0c8b07fada39eb07
Opcode Fuzzy Hash: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction Fuzzy Hash: 0DF0BB35901331DBF2329B749C89F1A3AA6EF097B1F214318F6559E1A1CB30D8C29690

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0CE Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102

Part of subcall function 100189EE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 10018AC2

DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
DeleteCriticalSection.KERNEL32 ref: 1001A125
DeleteCriticalSection.KERNEL32 ref: 1001A12D
DeleteCriticalSection.KERNEL32 ref: 1001A135

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction ID: 436f94670acdd869086ea8be0b95e1bb75b4415bd69928cd2107d9a27a45b4f1
Opcode Fuzzy Hash: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction Fuzzy Hash: 1AF0F4268002647AEA65F719AD8C8A97BD5DB822B27920476EC53B7030CD778CC29DA5

Uniqueness

Uniqueness Score: -1.00%

Function 693C2830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693C2893

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

__CxxThrowException@8.LIBCMT ref: 693C28BD

Strings

0M?i, xrefs: 693C28B6
Cannot find listfile, xrefs: 693C28B5

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: 0M?i$Cannot find listfile
API String ID: 3476068407-3943224005
Opcode ID: d4dc591ef7906f1af690d4db40ca940b3639722b7a83afad5eab75f7be279c7c
Instruction ID: edf0f09fbe79c5aa9bb745ebdb90ba69109aad8449a61bf4ab93677669d39fdc
Opcode Fuzzy Hash: d4dc591ef7906f1af690d4db40ca940b3639722b7a83afad5eab75f7be279c7c
Instruction Fuzzy Hash: EC3193B6D00659DBCB00CF99CA80AEFF7B8FF48314F404669E954B3240D7359E068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 693C3BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 693C3C22
__fileno.LIBCMT ref: 693C3C3E
__fileno.LIBCMT ref: 693C3C5A

Strings

(_?i, xrefs: 693C3BF3

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: __fileno
String ID: (_?i
API String ID: 1873356214-1335018112
Opcode ID: 2ebba008676c8217ba144919bb1023ce987bceaca526756807f1979d7a22d7d8
Instruction ID: 5d5160dc7d1b955b6fc69bd6db3a6f9c6f52807e553093bee95eb2860b350505
Opcode Fuzzy Hash: 2ebba008676c8217ba144919bb1023ce987bceaca526756807f1979d7a22d7d8
Instruction Fuzzy Hash: 8031B6B6509781AFD711CB748540B8AFBA9AF15304F44C6AED498C7702D736FC04C761

Uniqueness

Uniqueness Score: -1.00%

Function 693D5F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 693D5F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 693D5F9F

Strings

GetMethodProperty, xrefs: 693D5F77
GetNumberOfMethods, xrefs: 693D5F99

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: 677bdfb5272b5c1d3e1aa9add10a4ab5444b1c12884f62d72d7d89df1de27a05
Instruction ID: 635b170bc4dc9b41cda1042d8a454d00f8722761884d204919336a80c8e42cee
Opcode Fuzzy Hash: 677bdfb5272b5c1d3e1aa9add10a4ab5444b1c12884f62d72d7d89df1de27a05
Instruction Fuzzy Hash: EB214176E01319EBCB00DF95E9909DEB7B9FF48348F508016E914E7205E735E90ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 693D5BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,693EFD48,ADDB68B1,00000000,?,80000001,00000000,693EFD48,000000FF,?,693D5DBD,?,693FFCC8), ref: 693D5C1D

Part of subcall function 693D2FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,693D5DBD,?,?,693D5C37,?,693D5DBD,?,693FFCC8,00000000,00000000), ref: 693D300E
Part of subcall function 693D2FE0: RegQueryValueExW.ADVAPI32(693D5DBD,Path,00000000,693D5DBD,?,693D5DBD,?,693D5DBD,?,693FFCC8,00000000,00000000), ref: 693D304E

RegCloseKey.ADVAPI32(?,?,693D5DBD,?,693FFCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 693D5C47
RegCloseKey.ADVAPI32(?,?,693D5DBD,?,693FFCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 693D5C65

Strings

Software\7-zip, xrefs: 693D5C11

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: 6cf9be113ab7f0b5aac21a1fc23fc707ef5a990e7c43422fcb8106a6526085ae
Instruction ID: 40467a467721a9a2449f46b3460104112934ca35675dde2c93b23bf055633528
Opcode Fuzzy Hash: 6cf9be113ab7f0b5aac21a1fc23fc707ef5a990e7c43422fcb8106a6526085ae
Instruction Fuzzy Hash: D5115E77905A68ABCB118F549D44AAFBB6CFB06B61F00066BF826A7200D7356A0987D4

Uniqueness

Uniqueness Score: -1.00%

Function 693DC8BE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693DC8C2

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

GetLastError.KERNEL32(00000000,00000000), ref: 693DC8C7

Strings

R?i, xrefs: 693DC931, 693DC937
7-Zip cannot load Mapi32.dll, xrefs: 693DC8D2

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorExceptionException@8LastRaiseThrow
String ID: 7-Zip cannot load Mapi32.dll$R?i
API String ID: 2060628206-2163279805
Opcode ID: 09aad982076fe30f060c26c5edc5da4200e3e0561f94c9e83ea2186d14f3a101
Instruction ID: e2fa7c279872785863b012398fbf0073464856b859970fd655840c2d2a91efe9
Opcode Fuzzy Hash: 09aad982076fe30f060c26c5edc5da4200e3e0561f94c9e83ea2186d14f3a101
Instruction Fuzzy Hash: 4311C4B6904248DEEB00DBE4DD10BDDB7B8EF44318F54819DE54897280DB315E08CB63

Uniqueness

Uniqueness Score: -1.00%

Function 693EB090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 693EB0A3

Part of subcall function 693EAFFE: ___BuildCatchObjectHelper.LIBCMT ref: 693EB034

_UnwindNestedFrames.LIBCMT ref: 693EB0BA
___FrameUnwindToState.LIBCMT ref: 693EB0C8

Strings

csm, xrefs: 693EB09F, 693EB0B4, 693EB0C7, 693EB0E5, 693EB0F5

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction ID: 9e44c00258741e6dbb967860d161eee518635818ca6ccc7e6fca1e6dd41b487e
Opcode Fuzzy Hash: 140d385d04fdb06c5864635da4643ae5f7030d20822db344ff7144d47db4523a
Instruction Fuzzy Hash: 6701E875001629BBDF129F52CC45EAB7E7AFF04358F008012BD6859120DB32A9A1DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 693DF640 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693DF66A

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

-r, xrefs: 693DF693
-r-, xrefs: 693DF681
-r0, xrefs: 693DF66F

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: -r$ -r-$ -r0
API String ID: 3976011213-1696425382
Opcode ID: d1a3301042a2281550448d1ed68e0d5324d625354135fd7d29b102a6487ad7bb
Instruction ID: 34af3b0f010c743a1f5833391b462ba8bbbb5bc04f31c58ccb6e2c28a3898b57
Opcode Fuzzy Hash: d1a3301042a2281550448d1ed68e0d5324d625354135fd7d29b102a6487ad7bb
Instruction Fuzzy Hash: 4CF0ED2A725018A7C601CAADAE58B6D77ACD701508F808A86F808D7B60C763CE1653CB

Uniqueness

Uniqueness Score: -1.00%

Function 100197CF Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction ID: c5e9eab5286596022c0fc86455b854ac72cbfdbbf2fd81343e62aa3bf37372db
Opcode Fuzzy Hash: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction Fuzzy Hash: 7791C371D01664AADB11EB68CC81ADE7AF9EF497A0F600226F854BE191D731DDC0CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001B010 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,10025958,10025958,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B031
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B055
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B06F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?), ref: 1001B130
HeapFree.KERNEL32(00000000,00000000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?,?), ref: 1001B147

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction ID: 9791cdc1e8676e8be9240cb2db72b85fdf48b460ca22e9baef45e6ba91bfb517
Opcode Fuzzy Hash: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction Fuzzy Hash: F4312670500B56EBE332CF24CCC5B2677E0EB447A5FA14529F5669B290E771E8C5CB48

Uniqueness

Uniqueness Score: -1.00%

Function 693ECEA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 693ECEDC
__isleadbyte_l.LIBCMT ref: 693ECF10
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 693ECF41
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 693ECFAF

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: afd74c55adffca7ec0a42438ee145cdd80725569d508fe02718b3202153441f3
Instruction ID: 572450f4a8f7737d1716f5495525f0a6923ed7c0baedbf86094c82777ebe4f49
Opcode Fuzzy Hash: afd74c55adffca7ec0a42438ee145cdd80725569d508fe02718b3202153441f3
Instruction Fuzzy Hash: 6E31E131A142A6EFDF00CF68C890AAE7FB5FF02312F0185AAF0619B190D332D951DB50

Uniqueness

Uniqueness Score: -1.00%

Function 693D0F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,ADDB68B1,00000000,?,?,00000000,00000000,00000000), ref: 693D0FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 693D100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 693D1033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 693D103F

Part of subcall function 693D28A0: GetCurrentDirectoryW.KERNEL32(00000105,?,ADDB68B1,FFFFFFFF,?,00000004), ref: 693D2994

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: db49f28b8c466ff1f390269f27af0620e2ffbc6096606d7dc1a89189bcf1e436
Instruction ID: ed24938fd1429053cb8cdf0115f7d428f19ba27e74df1988a06b4e2afb458934
Opcode Fuzzy Hash: db49f28b8c466ff1f390269f27af0620e2ffbc6096606d7dc1a89189bcf1e436
Instruction Fuzzy Hash: E521B572600244BBEB10DF54DC85FAFB7BCFB45764F104229FA25A72C0C7756E0986A1

Uniqueness

Uniqueness Score: -1.00%

Function 1000112C Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1000112C
CharUpperW.USER32 ref: 10001144
GetLastError.KERNEL32 ref: 10001150
CharUpperA.USER32(?), ref: 10001183

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CharUpper$ErrorH_prologLast
String ID:
API String ID: 826227211-0
Opcode ID: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction ID: 99cf40d06858b6207db1331b5053b1e25ae539a9e8e767eb293be6f8fe8ea0fc
Opcode Fuzzy Hash: ff1246a03657b54eff9156cf09a95992e04e2b4fa534e0be7897412a772be6bf
Instruction Fuzzy Hash: 8A11043590025BDFEB05EFA0D8919EEB7F4FF09384F200424F542A2269EB705E41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 693DD4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(693FFC98,ADDB68B1,?,?,?,693EFB68,000000FF), ref: 693DD4F2
LeaveCriticalSection.KERNEL32(693FFC98,?,?,?,693EFB68,000000FF), ref: 693DD50A
LeaveCriticalSection.KERNEL32(693FFC98,?,?,?,?,693EFB68,000000FF), ref: 693DD547

Strings

[Content], xrefs: 693DD52D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: f68f90644bec362e43be2ea0e82d4643a8d6ec898e463bc51fedf4894a5200cf
Instruction ID: 34856b0a21a5985bb54b2ad72da8a865775a6d50fdb2af4c625c052bc5a48fb8
Opcode Fuzzy Hash: f68f90644bec362e43be2ea0e82d4643a8d6ec898e463bc51fedf4894a5200cf
Instruction Fuzzy Hash: BE01007B804158AFC720DF58D804B9DBBE8FB0A320F80826BEC22D3A80D7756904DB94

Uniqueness

Uniqueness Score: -1.00%

Function 693C1A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 693C1A4E
ReadFile.KERNEL32(00000000), ref: 693C1A55
GetLastError.KERNEL32 ref: 693C1A72
GetLastError.KERNEL32 ref: 693C1A80

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5c7fa2b848bd419f51fe6f08a30046d2fc12ff96788bd0739fd35cdecdf4e9b8
Instruction ID: c5170d1a000258557d237adc0c3269a4e46a04c1caccc4470a48937cec9df3b2
Opcode Fuzzy Hash: 5c7fa2b848bd419f51fe6f08a30046d2fc12ff96788bd0739fd35cdecdf4e9b8
Instruction Fuzzy Hash: A501D13730020A9BDB00CAD4AD00BBB33ACAB453A0F10843BF916C6280D636DC50A7A3

Uniqueness

Uniqueness Score: -1.00%

Function 693EBE2A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 693EBE36

Part of subcall function 693E72BB: __getptd_noexit.LIBCMT ref: 693E72BE
Part of subcall function 693E72BB: __amsg_exit.LIBCMT ref: 693E72CB

__getptd.LIBCMT ref: 693EBE4D
__amsg_exit.LIBCMT ref: 693EBE5B
__lock.LIBCMT ref: 693EBE6B

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 5e64ff8b42928f0ab59ff00719809af82cfc0d5fd2729725d4bec00406d1b12d
Instruction ID: ff1c87719be34a70e1abf806dbf937548f5aa5f3dc1c8520a92dfae0638b91fc
Opcode Fuzzy Hash: 5e64ff8b42928f0ab59ff00719809af82cfc0d5fd2729725d4bec00406d1b12d
Instruction Fuzzy Hash: 20F0903A900B248ADB62DBA6940474D73B0AF44718F00A55BE5A29F3D1CB306901CB93

Uniqueness

Uniqueness Score: -1.00%

Function 693E1C20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693E1C93

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

|2?i, xrefs: 693E1C8C
map/set<T> too long, xrefs: 693E1C5A

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: map/set<T> too long$|2?i
API String ID: 3976011213-3375660019
Opcode ID: bb9ed7f1f541b7eeef70bff2ca7ac1a97161f8a0ef13af645da5cf9753c7559f
Instruction ID: d085334b6192de077709c137e9e3a1ad2399a58dd9cd3ab88b3ba4562a815883
Opcode Fuzzy Hash: bb9ed7f1f541b7eeef70bff2ca7ac1a97161f8a0ef13af645da5cf9753c7559f
Instruction Fuzzy Hash: 61A175B6945A62DFC704CF58C280415FBB6BF8A714329C29EE8595B754C732F882CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 100081EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100081F4

Strings

, xrefs: 100083D3
, xrefs: 100083AB

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction ID: 9585d42676a0d41e953fe7fe136552d86f024f2135ab78c93d006785aed77b76
Opcode Fuzzy Hash: 312c2aec7e709d08ccb2c85a8bc715850654904397243e69b9c15c2e37b53766
Instruction Fuzzy Hash: D471583090060ACFEB20CF94C881AAEB7B1FF88394F50456DD596A7255DB30BB86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 693DFC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693DFD8E
__CxxThrowException@8.LIBCMT ref: 693DFDA3

Strings

-u, xrefs: 693DFC64

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throw
String ID: -u
API String ID: 2005118841-3343466670
Opcode ID: 91bc56d79f65bb0e206816b31c0aeb8b48cd3401f96411259f8ead0f9e4fd974
Instruction ID: 501ffbeefb03629785dc898d7d41df1fec94dbd954d4c083bfd66850c30b5512
Opcode Fuzzy Hash: 91bc56d79f65bb0e206816b31c0aeb8b48cd3401f96411259f8ead0f9e4fd974
Instruction Fuzzy Hash: 8041A37BD24248EBCB01CF98C990ADEB7F8FF55344F90C516E854E7200D7709A59ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 1001D6B7

Strings

, xrefs: 1001D700
, xrefs: 1001D6DC

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction ID: 27a1dab1f5f815cb8d427bf576b62c8b4ec6ff9cec70f847aa7466e11b016868
Opcode Fuzzy Hash: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction Fuzzy Hash: 2B41483140436C1AEB11FA64CD85FEA7F9ADB01744F1006F7D585CF092D271C989DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 693C3CF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

CharUpperW.USER32(00000000,ADDB68B1,00000002,00000000,00000000,693C43B8,0000001B,000000FF,(_?i,00000002), ref: 693C3D92

Strings

Incorrect command line, xrefs: 693C3E02
\?i, xrefs: 693C3D9E

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: CharUpper
String ID: Incorrect command line$\?i
API String ID: 9403516-1708279139
Opcode ID: fb5cfb84717aaf6e80508fbd915dee7e9f78dff80e37ed9d9c056a9fbb30726d
Instruction ID: be6d2bf9ea209a7317cf732acb55e3825ad7abc83359ad8be5cf1a37684dd16f
Opcode Fuzzy Hash: fb5cfb84717aaf6e80508fbd915dee7e9f78dff80e37ed9d9c056a9fbb30726d
Instruction Fuzzy Hash: 8C411FB6E04505CFCB10EF98D880AAAF7B4FB48320F10826AED5997340D735AD41C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 693C8400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693C84F6

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693C8510

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

,S?i, xrefs: 693C8449

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: ,S?i
API String ID: 2732643326-3387600051
Opcode ID: c7495501cc9542a68a1195200eec69f1f28bfae89585dd5d1e07624835d37481
Instruction ID: 321aaa0870804abd7287761d41c37866d0a842e70ea35aca8d69a514ccd6be1a
Opcode Fuzzy Hash: c7495501cc9542a68a1195200eec69f1f28bfae89585dd5d1e07624835d37481
Instruction Fuzzy Hash: 535110B5A05B86EEC710CF6AC58078AFBE4BF19304F908A6ED4ADC7A00D371B555CB91

Uniqueness

Uniqueness Score: -1.00%

Function 693DFDE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 693DFE54
__CxxThrowException@8.LIBCMT ref: 693DFED8

Strings

-v, xrefs: 693DFE5D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: Exception@8Throwwsprintf
String ID: -v
API String ID: 2898814609-1581256980
Opcode ID: 9ca287fe7320cbed8a39bbe8cdf1992bbd82a2107fecf1c48a5d64794791ad36
Instruction ID: d70290d55bfcd23b2a08c1c7955eb236ca6a6a46ac640ca9bafff37e220ec22c
Opcode Fuzzy Hash: 9ca287fe7320cbed8a39bbe8cdf1992bbd82a2107fecf1c48a5d64794791ad36
Instruction Fuzzy Hash: 53317576D00658DFCB10CFE9C984A9EFBF8FF48304F50852AE555EB241E7759A088B91

Uniqueness

Uniqueness Score: -1.00%

Function 693D0AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,0000005F,00000000,ADDB68B1,00000000), ref: 693D0B62
__CxxThrowException@8.LIBCMT ref: 693D0B88

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

_, xrefs: 693D0B25

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ByteCharExceptionException@8MultiRaiseThrowWide
String ID: _
API String ID: 3144726602-701932520
Opcode ID: 1fcb2ba39f950a52531fbae1d92af5fc8e54e8685f5eb367414c4355bbed1e4e
Instruction ID: 03915baab234e65d5523ccef777e866698b6eb213f9c18823b6c6c56643af22b
Opcode Fuzzy Hash: 1fcb2ba39f950a52531fbae1d92af5fc8e54e8685f5eb367414c4355bbed1e4e
Instruction Fuzzy Hash: 46219F76904249EFCB00CF59C980B9AFBF8FF89718F10855AE9149B241D771AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 693D2FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,693D5DBD,?,?,693D5C37,?,693D5DBD,?,693FFCC8,00000000,00000000), ref: 693D300E
RegQueryValueExW.ADVAPI32(693D5DBD,Path,00000000,693D5DBD,?,693D5DBD,?,693D5DBD,?,693FFCC8,00000000,00000000), ref: 693D304E

Strings

Path, xrefs: 693D3002, 693D3045

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: a063a3ca3e043080130bd933c084f5228d11d249c876a019dea0466dc033788b
Instruction ID: 550c23c164ed5f6df105db1aed76fb5d14db13efc685f14fdfae1816f973aa9a
Opcode Fuzzy Hash: a063a3ca3e043080130bd933c084f5228d11d249c876a019dea0466dc033788b
Instruction Fuzzy Hash: 75118FB2A04204AFEB14DFA8C9D08AEF7B9FF48744B20846EE556D3210E7719D448B91

Uniqueness

Uniqueness Score: -1.00%

Function 693C22F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693C231A

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693C2336

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

dL?i, xrefs: 693C233B

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: dL?i
API String ID: 2732643326-2150643756
Opcode ID: 1597c69a135f52f4462ce390d3880b40ca6bd703324c3ccef10ce01a2d4949f8
Instruction ID: d9fdc81984bbfceb5edefb5b1492c61a59b3e8f76de122cf77b61d9d366e8680
Opcode Fuzzy Hash: 1597c69a135f52f4462ce390d3880b40ca6bd703324c3ccef10ce01a2d4949f8
Instruction Fuzzy Hash: 2D218EB5900608AFC720CF5DC980A9AFBFCFF49724F50C62EE55993740D731AA068BA0

Uniqueness

Uniqueness Score: -1.00%

Function 693C5480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 693C54AD

Part of subcall function 693E5F2A: __FF_MSGBANNER.LIBCMT ref: 693E5F4D
Part of subcall function 693E5F2A: __NMSG_WRITE.LIBCMT ref: 693E5F54
Part of subcall function 693E5F2A: RtlAllocateHeap.NTDLL(00000000,693CFA6F,?,00000000,?,?,693C4D3F,0000000C,ADDB68B1,?,?,00000000,?,?,693EEF9B,000000FF), ref: 693E5FA1

__CxxThrowException@8.LIBCMT ref: 693C54C7

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

7<i, xrefs: 693C549D

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_malloc
String ID: 7<i
API String ID: 2732643326-1306940000
Opcode ID: 54967f7d07fe7d14a3ee1e1b71f0c667173f905a23f2e762e9c64df16a4bb4eb
Instruction ID: 66fe4c108f609e8a6fcb4d89919aff9f6219f1e622142e6f459fb00db624e9fd
Opcode Fuzzy Hash: 54967f7d07fe7d14a3ee1e1b71f0c667173f905a23f2e762e9c64df16a4bb4eb
Instruction Fuzzy Hash: 6611B1B6608605EFD714CF58C881B5BB7E9EB45314F00862EE8A6C7790EB31BD048B51

Uniqueness

Uniqueness Score: -1.00%

Function 693CED10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693CED86

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Part of subcall function 693CEDB0: std::exception::exception.LIBCMT ref: 693CEDDE

Strings

vector<T> too long, xrefs: 693CED3B
|2?i, xrefs: 693CED7E

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::exception::exception
String ID: vector<T> too long$|2?i
API String ID: 4171481480-1040430243
Opcode ID: 5626959f8588037332b96785e10eeb039dee0877b4138e8c47c415d184065db7
Instruction ID: 07155f1301c450ab3725aa3a48d233170b1e9ff7c3caf70d598d23e5347c44e7
Opcode Fuzzy Hash: 5626959f8588037332b96785e10eeb039dee0877b4138e8c47c415d184065db7
Instruction Fuzzy Hash: EA018875008344ABC710DF58D845B9BBBE8AB58754F404A1DF59497280DB74E908CB97

Uniqueness

Uniqueness Score: -1.00%

Function 693EAE09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 693E69BB: __getptd.LIBCMT ref: 693E69C1
Part of subcall function 693E69BB: __getptd.LIBCMT ref: 693E69D1

__getptd.LIBCMT ref: 693EAE18

Part of subcall function 693E72BB: __getptd_noexit.LIBCMT ref: 693E72BE
Part of subcall function 693E72BB: __amsg_exit.LIBCMT ref: 693E72CB

__getptd.LIBCMT ref: 693EAE26

Strings

csm, xrefs: 693EAE34

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction ID: a0c935812de75a24702fc9feebdd97aa971417fc7bdf146218cd18764558b27b
Opcode Fuzzy Hash: c868b9202c40c128ab5c124d4baf2a7191ffbd882dd3f7671e77d16ed862952d
Instruction Fuzzy Hash: D90169388016258FCF24CFE0D584AADB7B6BF40326F20942FF481E66A0CB329585CB51

Uniqueness

Uniqueness Score: -1.00%

Function 693EE688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 693EE66F

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

std::bad_exception::bad_exception.LIBCMT ref: 693EE697

Strings

Access violation - no RTTI data!, xrefs: 693EE68F

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::bad_exception::bad_exception
String ID: Access violation - no RTTI data!
API String ID: 1843230569-2158758863
Opcode ID: 6134674dbe7f68f5d95339eb06ec781566df2855b35a4e9ac02091508fc1df84
Instruction ID: bc4bf70cba7116c8e72a27c5bbccd0d10e4b56153f1219a4e7d1b642d2db0699
Opcode Fuzzy Hash: 6134674dbe7f68f5d95339eb06ec781566df2855b35a4e9ac02091508fc1df84
Instruction Fuzzy Hash: C2E0C77AA20208DFCF00CBA8C880EEE73B4AB0930AF000006E402F3250D730E942CF20

Uniqueness

Uniqueness Score: -1.00%

Function 693E518F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 693E5196
__CxxThrowException@8.LIBCMT ref: 693E51C1

Part of subcall function 693E663B: RaiseException.KERNEL32(?,693E0629,ADDB68B1,?,?,693E0629,?,693F8388,ADDB68B1), ref: 693E667D

Strings

invalid string position, xrefs: 693E519B

Memory Dump Source

Source File: 0000000A.00000002.2608510217.00000000693C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 693C0000, based on PE: true

Associated: 0000000A.00000002.2608455573.00000000693C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608669852.00000000693F3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2608905305.00000000693FD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069403000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.2609027014.0000000069428000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_693c0000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: cfe676490c5b935d23056b963c7953046e46bf1d73958c272cbd9352749d828e
Instruction ID: 7acf173d742e0978ec43f72c07d88c0584b521323f97423b3ca6bb15a87594c7
Opcode Fuzzy Hash: cfe676490c5b935d23056b963c7953046e46bf1d73958c272cbd9352749d828e
Instruction Fuzzy Hash: 70D0627585012C9BDB04DBD4CD44FDD77786B54358F449416D245A6040DB646E058665

Uniqueness

Uniqueness Score: -1.00%

Function 1001AB6E Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001AB96
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001ABCA
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001ABE4
HeapFree.KERNEL32(00000000,?), ref: 1001ABFB

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction ID: 484c1ce75c38baac158856a15f7ab205fd40ab6127819ea80900b3ceb95b3c03
Opcode Fuzzy Hash: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction Fuzzy Hash: E8112570240321AFE721EF19CCC6A167BF6FB86764B61491AF552C69B1D3729CA2CF40

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0A5 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,1001BFB2,?,10019F53), ref: 1001A0B2
InitializeCriticalSection.KERNEL32 ref: 1001A0BA
InitializeCriticalSection.KERNEL32 ref: 1001A0C2
InitializeCriticalSection.KERNEL32 ref: 1001A0CA

Memory Dump Source

Source File: 0000000A.00000002.2607831949.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000A.00000002.2607740002.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608143447.0000000010020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608265704.0000000010025000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608324416.0000000010027000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2608397098.000000001002F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction ID: bb73eb11f573fb0f18e311b5dd9e76b2e5dde51fe535fe889abf8312516ef5db
Opcode Fuzzy Hash: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction Fuzzy Hash: BEC00231801138AFFA556B55DC848493FA6EB042723210063E10561030CEB31C93DFE8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: x64DPInst.exePID: 1172, Parent PID: 3292COMMON

Non-executed Functions

Function 00007FF70822D440 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF70822D477
GetCurrentProcessId.KERNEL32 ref: 00007FF70822D482
GetCurrentThreadId.KERNEL32 ref: 00007FF70822D48E
GetTickCount.KERNEL32 ref: 00007FF70822D49A
QueryPerformanceCounter.KERNEL32 ref: 00007FF70822D4AB

Memory Dump Source

Source File: 00000010.00000002.2208938740.00007FF7081D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF7081D0000, based on PE: true

Associated: 00000010.00000002.2208853468.00007FF7081D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2209008753.00007FF708251000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2209058956.00007FF708253000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2209058956.00007FF708268000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7081d0000_x64DPInst.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction ID: 6abba7574129f2c7a9054b09840ed3b7b13763aa607902ab1358a97ebd7aa35d
Opcode Fuzzy Hash: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction Fuzzy Hash: D7013022658B0692EB509B21FC50365F360FF45BA0F846634EE5E47794CF3CD9958324

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8ue90oYkrv.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

5c6a94.rbf (copy)

C:\Config.Msi\5c6a93.rbs

C:\Config.Msi\5c6a98.rbs

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.config

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll

Windows Analysis Report
8ue90oYkrv.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre