Edit tour

Windows Analysis Report
8ue90oYkrv.exe

Overview

General Information

Sample name:	8ue90oYkrv.exe
Analysis ID:	1408892
MD5:	5a0d2bc66c17c640e81233cf6a200e07
SHA1:	65ab84dc66feb7b7034ec5713b68fd39a6cd1a01
SHA256:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	49
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

.NET source code contains potential unpacker

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates Visual Basic Runtime Dlls

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: Use Short Name Path in Command Line

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

svchost.exe (PID: 5224 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc MD5: F586835082F632DC8D9404D83BC16316)

8ue90oYkrv.exe (PID: 3760 cmdline: C:\Users\user\Desktop\8ue90oYkrv.exe MD5: 5A0D2BC66C17C640E81233CF6A200E07)

TDService.exe (PID: 5868 cmdline: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="" MD5: A94A3D60FA8A54AB71ABED39D5883D86)

TechkonDriver64Bit.exe (PID: 3060 cmdline: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s MD5: F6CD94DEAEA55BB414650D6A9CB7DD6C)

TechkonDriver64Bit.exe (PID: 5720 cmdline: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="" MD5: 5A3DA2206BD35C381B826FF748093684)

cmd.exe (PID: 6616 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

x64DPInst.exe (PID: 4736 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 3000 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 3344 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 4932 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 4772 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 2980 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 4828 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

x64DPInst.exe (PID: 3640 cmdline: C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F MD5: BE3C79033FA8302002D9D3A6752F2263)

msiexec.exe (PID: 6404 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6360 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding FC59D1BB68DDFDC1E5D4349A53CC36CC MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6208 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6616 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx MD5: 9D09DC1EDA745A5F87553048E57620CF)

conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

certutil.exe (PID: 3044 cmdline: certutil -f -addstore TrustedPublisher TK1.cer MD5: BD8D9943A9B1DEF98EB83E0FA48796C2)

certutil.exe (PID: 4168 cmdline: certutil -f -addstore TrustedPublisher TK2.cer MD5: BD8D9943A9B1DEF98EB83E0FA48796C2)

msiexec.exe (PID: 4816 cmdline: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4236 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 60A2701AE26538E52DD17AD6BC358181 MD5: 9D09DC1EDA745A5F87553048E57620CF)

TDService.exe (PID: 6476 cmdline: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe" MD5: F00223A56D3F89627CC88625DBCB0C42)

svchost.exe (PID: 7668 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: F586835082F632DC8D9404D83BC16316)

drvinst.exe (PID: 2036 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.inf" "9" "439f12f93" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "c:\progra~1\techko~1\techko~1\dens" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 3696 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\mf-ir" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 1720 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 600 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.inf" "9" "4b5792527" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~4" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 636 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.inf" "9" "40b9ce367" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\spectr~3" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 1756 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.inf" "9" "48bc6c0e7" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\spectr~2" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 1672 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.inf" "9" "46d73562f" "0000000000000178" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~1" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

drvinst.exe (PID: 1500 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.inf" "9" "4c691d78b" "0000000000000190" "WinSta0\Default" "000000000000012C" "208" "c:\progra~1\techko~1\techko~1\spc171~1" MD5: D26EB7BD11479C9C3C5CB5641C4360E1)

svchost.exe (PID: 5824 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 2524 cmdline: C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\miaE9AF.tmp\TDService.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000000.167625105498.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.TDService.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Suspicious Msiexec Execute Arbitrary DLL

Source: Process started

Author: frack113: Data: Command: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, CommandLine: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: C:\Windows\system32\msiexec.exe /V, ParentImage: C:\Windows\System32\msiexec.exe, ParentProcessId: 6404, ParentProcessName: msiexec.exe, ProcessCommandLine: C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll, ProcessId: 6208, ProcessName: msiexec.exe

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", CommandLine: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\ProgramData\miaE9AF.tmp\TDService.exe, NewProcessName: C:\ProgramData\miaE9AF.tmp\TDService.exe, OriginalFileName: C:\ProgramData\miaE9AF.tmp\TDService.exe, ParentCommandLine: C:\Users\user\Desktop\8ue90oYkrv.exe, ParentImage: C:\Users\user\Desktop\8ue90oYkrv.exe, ParentProcessId: 3760, ParentProcessName: 8ue90oYkrv.exe, ProcessCommandLine: .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k="", ProcessId: 5868, ProcessName: TDService.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", CommandLine: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, NewProcessName: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, OriginalFileName: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, ParentCommandLine: "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s, ParentImage: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe, ParentProcessId: 3060, ParentProcessName: TechkonDriver64Bit.exe, ProcessCommandLine: .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k="", ProcessId: 5720, ProcessName: TechkonDriver64Bit.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc, CommandLine: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 908, ProcessCommandLine: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc, ProcessId: 5224, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Virustotal: Detection: 9%			Perma Link
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Virustotal: Detection: 8%			Perma Link

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8ue90oYkrv.exe

Joe Sandbox ML: detected

Compliance

Uses 32bit PE files

Source: 8ue90oYkrv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Jump to behavior

PE / OLE file has a valid certificate

Source: 8ue90oYkrv.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb0eNe @e_CorExeMainmscoree.dll source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb,NNN @N_CorDllMainmscoree.dll source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\_thesycon\usb\usbio\_main\bin\fre\amd64\usbio_x64.pdb source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000318C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe
Source:	Binary string: gacutlrc.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: d:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00407AC0 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	3_2_00407AC0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA42A30 FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	4_2_6DA42A30
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA32470 FindClose,FindFirstFileW,FindFirstFileW,	4_2_6DA32470
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A172A30 FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	13_2_6A172A30
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A162470 FindClose,FindFirstFileW,FindFirstFileW,	13_2_6A162470

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Source: TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP
Source: TDService.exe, 00000004.00000003.168283345562.00000000028DB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.TECHKON.COM/MICROSOFT
Source: drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sawebservice.red-gate.com/
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2008/schema.xsd
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crlb$
Source: drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMz
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/
Source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/InstallAware
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/buydirect.aspopen
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.com/x2/
Source: 8ue90oYkrv.exe, 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167929283940.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.168281434764.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000002.168290671231.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000002.168278210797.0000000000440000.00000002.00000001.01000000.0000000D.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167699894798.000000007FE3A000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000000.167698325162.000000000095B000.00000002.00000001.01000000.0000000E.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.000000000345C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.installaware.comz
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.168283345562.0000000002908000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TECHKON
Source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167699894798.000000007F940000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.00000000033E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zip
Source: TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zipiJ
Source: TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mywebsite.com/TechkonDriver64Bit.7zipn
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_me
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/L
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/UploadReport2
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
Source: TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.00000000028B4000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.00000000033E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.techkon.com/
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F940000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.168283345562.00000000028DB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.techkon.com/Microsoft

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET5181.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\1ABF3862\DFC33D3E\spectrodens_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET863D.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\9E7D6EA9\A1D4A3D9\TK2.cer	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9CD2.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6D85.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3CC0.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\52B152B3\9B44F18F\spectrodrive_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\B06B5044\C2555B5\spectrojet_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET407A.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET81D8.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA1A.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA1A5.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\F2F92670\383AE05B\spectrodrive_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.cat (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET2550.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBC8F.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\56A7DD7A\5EDECBEE\spectrojet_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD4EA.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\4D56F533\BD12AE78\spectrodens_ir_x64.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET553A.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET695E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\849003A2\CFFA0AE5\spectroplate_x64.cat	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB80B.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET290A.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\66E41FEB\A1D4A3D9\TK1.cer	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\7AA455DC\9C4070E9\dens_x64.cat	Jump to dropped file

System Summary

Abnormal high CPU Usage

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Process Stats: CPU usage > 6%

Creates Visual Basic Runtime Dlls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior

Creates driver files

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys

Jump to behavior

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe31.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{CD1E6019-47AE-4334-A91E-595BA68B6E06}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFF8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI28.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe35.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe35.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe36.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1930.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19AE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{55EA8940-B618-47BD-A642-20BFB2A64F78}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19FD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1A2D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1A6D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe39.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\161fe39.msi	Jump to behavior
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Windows\DPINST.LOG
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\dens_x64.inf_amd64_0443b10bbf7d32a7
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem9.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodens_ir_x64.inf_amd64_8d12fea260853771
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem12.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectroplate_x64.inf_amd64_c71201b931dd1be0
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem27.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrojet_x64.inf_amd64_5ffa68417e0a7d5b
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem28.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodrive_x64.inf_amd64_4202c4b809e7c711
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem29.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodrive_x64.inf_amd64_2098370fcaa48685
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem30.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrodens_x64.inf_amd64_f8d6912081a30de7
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem31.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\spectrojet_x64.inf_amd64_8d9b062068cda5fb
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem32.inf

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIFEFC.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0041F2D0	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00419AA0	3_2_00419AA0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0040AEE0	3_2_0040AEE0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00401100	3_2_00401100
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004011C0	3_2_004011C0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004011D8	3_2_004011D8
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004042D0	3_2_004042D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004102D0	3_2_004102D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004013F0	3_2_004013F0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0040E440	3_2_0040E440
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0042244E	3_2_0042244E
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00405510	3_2_00405510
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004045A0	3_2_004045A0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004015B0	3_2_004015B0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00403760	3_2_00403760
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004128A0	3_2_004128A0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0040D900	3_2_0040D900
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00401AB0	3_2_00401AB0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00408DD0	3_2_00408DD0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0040EFF0	3_2_0040EFF0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA34C00	4_2_6DA34C00
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA2AE70	4_2_6DA2AE70
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA28AB0	4_2_6DA28AB0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA335F0	4_2_6DA335F0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA26460	4_2_6DA26460
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA3FEE0	4_2_6DA3FEE0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA48E1B	4_2_6DA48E1B
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA3B9C0	4_2_6DA3B9C0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA3E950	4_2_6DA3E950
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA2B447	4_2_6DA2B447
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA4E78B	4_2_6DA4E78B
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA4E6B0	4_2_6DA4E6B0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA2E670	4_2_6DA2E670
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA2D1B0	4_2_6DA2D1B0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10001000	13_2_10001000
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10009028	13_2_10009028
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10017330	13_2_10017330
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_100153E0	13_2_100153E0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1000D450	13_2_1000D450
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001E5C3	13_2_1001E5C3
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10017710	13_2_10017710
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001E751	13_2_1001E751
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1000E770	13_2_1000E770
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_100127E0	13_2_100127E0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001E82B	13_2_1001E82B
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_100178D0	13_2_100178D0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1000C8E0	13_2_1000C8E0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10014A40	13_2_10014A40
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1000EB10	13_2_1000EB10
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1000CCA0	13_2_1000CCA0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001AD1A	13_2_1001AD1A
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10016D80	13_2_10016D80
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10017DC0	13_2_10017DC0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10012F00	13_2_10012F00
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10016F80	13_2_10016F80
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A158AB0	13_2_6A158AB0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A15AE70	13_2_6A15AE70
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A164C00	13_2_6A164C00
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A156460	13_2_6A156460
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A1635F0	13_2_6A1635F0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A16E950	13_2_6A16E950
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A16B9C0	13_2_6A16B9C0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A178E1B	13_2_6A178E1B
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A16FEE0	13_2_6A16FEE0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A15D1B0	13_2_6A15D1B0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A15E670	13_2_6A15E670
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A17E6B0	13_2_6A17E6B0
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A17E78B	13_2_6A17E78B
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A15B447	13_2_6A15B447

Enables security privileges

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: String function: 6A177AA4 appears 37 times
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: String function: 10018EB0 appears 95 times
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: String function: 6A154C80 appears 39 times
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: String function: 00422A14 appears 35 times
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: String function: 6DA24C80 appears 39 times
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: String function: 6DA47AA4 appears 37 times

PE file contains executable resources (Code or Archives)

Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: TDService.exe1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: mia.lib.3.dr	Static PE information: Resource name: RC_DATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

PE file does not import any functions

Source: stdole2.tlb.3.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDSCON.ocx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.00000000041E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zxa.dll, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003C7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedzncore.dll vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003C7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedznet.dllD vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003CBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelcms.dll vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.000000000413B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.000000000413B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF16.DLL5%ProductNameMicrosoft vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.000000000413B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameW95INF32.DLLj% vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003C0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameADVPACK.DLLx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003C3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomcat.dllx, vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004111000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUSBIOCOM.dllT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_wrapper.dll4 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameahadmin_.dll4 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGameuxInstallHelper.DLLb! vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameManagedVCL.Utils.dll8 vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutlrc.dllT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamez vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServiceLogMonitor.exeX vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTechkonSpectroDriveUpdate.exeT vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOLEPRO32.DLL( vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServiceConnection.dlld" vs 8ue90oYkrv.exe
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTDServerApp.exed" vs 8ue90oYkrv.exe

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capauthz.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wifidatacapabilityhandler.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cellulardatacapabilityhandler.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usbiocom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: netfxperf.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: version.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: mpr.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: winmm.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: winsta.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: olepro32.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: wldp.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: propsys.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: profapi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: srclient.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: spp.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: powrprof.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: vssapi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: vsstrace.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: msi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: srpapi.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: wkscli.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: netutils.dll
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: version.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: edgegdi.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: drvstore.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devrtl.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: spinf.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: slc.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: capauthz.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wifidatacapabilityhandler.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cellulardatacapabilityhandler.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentserver.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mrmdeploy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll

Uses 32bit PE files

Source: 8ue90oYkrv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TechkonSpectroJetUpdate.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDServerApp.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDService.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TDService.exe0.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TechkonSpectroDriveUpdate.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: TechkonSpectroJetUpdate.exe.3.dr, SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TechkonSpectroJetUpdate.exe.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TechkonSpectroJetUpdate.exe.3.dr, SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDServerApp.exe.3.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TDServerApp.exe.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDServerApp.exe.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDService.exe.3.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TDService.exe.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: TDService.exe.3.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal45.evad.winEXE@63/343@0/0

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_0041E6A0 GetVersion,CoCreateInstance,

3_2_0041E6A0

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

Code function: 4_2_6DA42980 LoadResource,SizeofResource,LockResource,CreateFileW,WriteFile,FindCloseChangeNotification,DeleteFileW,

4_2_6DA42980

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Code function: 11_2_0142A3E2 StartServiceCtrlDispatcherW,

11_2_0142A3E2

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0142A3E2 StartServiceCtrlDispatcherW,		11_2_0142A3E2
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0142A3B6 StartServiceCtrlDispatcherW,		11_2_0142A3B6

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\TECHKON GmbH

Jump to behavior

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

File created: C:\Users\user\AppData\Local\IIIQF

Jump to behavior

Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\DPINST_LOG_SCROLLER_MUTEX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Mutant created: NULL
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Mutant created: \BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:304:WilStaging_02
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

File created: C:\Users\user\AppData\Local\Temp\lang.loc

Jump to behavior

Source: Yara match	File source: 4.0.TDService.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.167625105498.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\miaE9AF.tmp\TDService.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe, type: DROPPED

Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: PTn	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: "-k=	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: "/k=	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: -k=	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: /k=	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Title	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: BeginPrompt	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Progress	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: Directory	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: RunProgram	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: ExecuteFile	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: @KA	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: setup.exe	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: %%T	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: %%T\	3_2_0041F2D0
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Command line argument: mia.lib	3_2_0041F2D0

Source: 8ue90oYkrv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: x64DPInst.exe	String found in binary or memory: Some post-install cleanup tasks failed. Error code is 0x%X
Source: x64DPInst.exe	String found in binary or memory: During undo of install, we failed to re-install the driver. Error code 0x%X
Source: x64DPInst.exe	String found in binary or memory: Error 0x%X - Could not delete service info key for '%ws', even though there are no more DIFx-installed driver stores using this se
Source: x64DPInst.exe	String found in binary or memory: Install option set: Suppress pre-install of Plug and Play drivers if no matching devices are present.
Source: x64DPInst.exe	String found in binary or memory: Successfully re-added '%s' to reference list of driver store entry '%s'
Source: x64DPInst.exe	String found in binary or memory: Could not re-add '%s' to reference list of driver store entry '%s'

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

File read: C:\Users\user\Desktop\8ue90oYkrv.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Source: unknown	Process created: C:\Users\user\Desktop\8ue90oYkrv.exe C:\Users\user\Desktop\8ue90oYkrv.exe
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process created: C:\ProgramData\miaE9AF.tmp\TDService.exe .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FC59D1BB68DDFDC1E5D4349A53CC36CC
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX
Source: unknown	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe"
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process created: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 60A2701AE26538E52DD17AD6BC358181
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.inf" "9" "439f12f93" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "c:\progra~1\techko~1\techko~1\dens"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.inf" "9" "4b5792527" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~4"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.inf" "9" "40b9ce367" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.inf" "9" "48bc6c0e7" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.inf" "9" "46d73562f" "0000000000000178" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.inf" "9" "4c691d78b" "0000000000000190" "WinSta0\Default" "000000000000012C" "208" "c:\progra~1\techko~1\techko~1\spc171~1"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process created: C:\ProgramData\miaE9AF.tmp\TDService.exe .\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FC59D1BB68DDFDC1E5D4349A53CC36CC	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 60A2701AE26538E52DD17AD6BC358181	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process created: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe .\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.inf" "9" "439f12f93" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "c:\progra~1\techko~1\techko~1\dens"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.inf" "9" "4b5792527" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~4"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.inf" "9" "40b9ce367" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.inf" "9" "48bc6c0e7" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.inf" "9" "46d73562f" "0000000000000178" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.inf" "9" "4c691d78b" "0000000000000190" "WinSta0\Default" "000000000000012C" "208" "c:\progra~1\techko~1\techko~1\spc171~1"

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Jump to behavior

PE / OLE file has a valid certificate

Source: 8ue90oYkrv.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: 8ue90oYkrv.exe

Static file information: File size 13453632 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServerLogMonitor\obj\x86\Release\TDServiceLogMonitor.pdb0eNe @e_CorExeMainmscoree.dll source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb,NNN @N_CorDllMainmscoree.dll source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GameuxInstallHelper.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb(0 source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Development\TDServiceSDK\Programm\TechkonDeviceService\TDServiceConnection\obj\x86\Release\TDServiceConnection.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000004103000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdbH source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\_thesycon\usb\usbio\_main\bin\fre\amd64\usbio_x64.pdb source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000318C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DpInst.pdb source: TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, x64DPInst.exe
Source:	Binary string: gacutlrc.pdb source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: TechkonSpectroJetUpdate.exe.3.dr, AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly.Load(byte[])
Source: TDServerApp.exe.3.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TDService.exe.3.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TDService.exe0.3.dr, --.cs	.Net Code: _001B_0008 System.Reflection.Assembly.Load(byte[])
Source: TechkonSpectroDriveUpdate.exe.3.dr, AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly.Load(byte[])

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_00425561 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00425561

PE file contains an invalid checksum

Source: lcms.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x35ee6
Source: TechkonSpectroJetUpdate.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xe77a0
Source: mVBExec.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x14f360
Source: TDServerApp.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x132619
Source: mMSIExec.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x16af1f
Source: dzncore.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x3f85f
Source: mia.lib.3.dr	Static PE information: real checksum: 0x78abd should be: 0xa3ca7
Source: TDService.exe0.3.dr	Static PE information: real checksum: 0x0 should be: 0x127b7b
Source: TDServiceLogMonitor.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x11f04
Source: TechkonSpectroDriveUpdate.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x1ba8a4
Source: stdole2.tlb.3.dr	Static PE information: real checksum: 0x0 should be: 0x52af
Source: TDService.exe1.3.dr	Static PE information: real checksum: 0x0 should be: 0x519d69
Source: TDService.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x127b7b

PE file contains sections with non-standard names

Source: mMSIExec.dll.3.dr	Static PE information: section name: .didata
Source: msvbvm60.dll.3.dr	Static PE information: section name: ENGINE
Source: mVBExec.dll.3.dr	Static PE information: section name: .didata
Source: TDService.exe1.3.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004300F8 push eax; retf	3_2_00430145
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004353B0 push eax; retf 0042h	3_2_004353B1
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00435484 push eax; retf	3_2_00435485
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00435494 pushad ; retf	3_2_00435495
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_0043368D pushad ; retf 0002h	3_2_00433699
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00422A59 push ecx; ret	3_2_00422A6C
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00434BC8 push eax; retn 0042h	3_2_00434BC9
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA47AE9 push ecx; ret	4_2_6DA47AFC
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0142268D push eax; retf	11_2_0142268E
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_01423162 push ebp; retf	11_2_0142316A
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_01422BB8 pushfd ; retf	11_2_01422BBE
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10013130 push ecx; mov dword ptr [esp], ecx	13_2_10013131
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001D2C0 push eax; ret	13_2_1001D2EE
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_10018EB0 push eax; ret	13_2_10018ECE
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A177AE9 push ecx; ret	13_2_6A177AFC

Source: TechkonSpectroJetUpdate.exe.3.dr	Static PE information: section name: .text entropy: 7.8810776452765055
Source: TDServerApp.exe.3.dr	Static PE information: section name: .text entropy: 7.851236452154908
Source: TDService.exe.3.dr	Static PE information: section name: .text entropy: 7.950881957105219
Source: TDService.exe0.3.dr	Static PE information: section name: .text entropy: 7.950881957105219
Source: TechkonSpectroDriveUpdate.exe.3.dr	Static PE information: section name: .text entropy: 7.905714785753008

Persistence and Installation Behavior

Drops PE files

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBD0E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6DE5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET40D9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET86AC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9D61.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD578.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19FD.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET559A.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 161fe34.rbf (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3D30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFF8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET25A1.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET69DD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI28.tmp	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19AE.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET51F0.tmp	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1930.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET8257.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA224.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA9.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET2969.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1A2D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	File created: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB89A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\TDService.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\olepro32.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\mia.lib	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\oleaut32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\TDService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19FD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET2969.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET559A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1A2D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFF8.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBD0E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\TDSCON.ocx	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6DE5.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI28.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET40D9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19AE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFC.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET86AC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1930.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\USBIOCOM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA224.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.sys (copy)	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	File created: C:\ProgramData\miaE9AF.tmp\mia.lib	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File created: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	File created: C:\ProgramData\miaB21.tmp\mia.lib	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	File created: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib	Jump to dropped file

Boot Survival

Creates or modifies windows services

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\TDServiceLog

Jump to behavior

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Code function: 11_2_0142A3E2 StartServiceCtrlDispatcherW,

11_2_0142A3E2

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 2090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Memory allocated: 4090000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Window / User API: threadDelayed 8924

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\lcms.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBD0E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6DE5.tmp	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\IIIQF\7z.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI28.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET40D9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI19AE.tmp	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFEFC.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET51F0.tmp	Jump to dropped file
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\asycfilt.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET86AC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1930.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9D61.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET8257.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA224.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD578.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFFA9.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI19FD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET2969.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\stdole2.tlb	Jump to dropped file
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET559A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3D30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFFF8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1A2D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB89A.tmp	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET25A1.tmp	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.sys (copy)	Jump to dropped file
Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET69DD.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\mVBExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	Dropped PE file which has not been started: C:\ProgramData\miaB21.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\comcat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Dropped PE file which has not been started: C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll	Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_3-18666
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_3-18763

Found large amount of non-executed APIs

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	API coverage: 7.5 %
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	API coverage: 8.0 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 4896	Thread sleep count: 199 > 30	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 4896	Thread sleep time: -39800s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6192	Thread sleep count: 8924 > 30	Jump to behavior
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe TID: 6192	Thread sleep time: -8924000s >= -30000s	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe TID: 6672	Thread sleep time: -44274s >= -30000s

Queries keyboard layouts

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809	Jump to behavior
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070409
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08090809

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00407AC0 FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,	3_2_00407AC0
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA42A30 FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	4_2_6DA42A30
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA32470 FindClose,FindFirstFileW,FindFirstFileW,	4_2_6DA32470
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A172A30 FindFirstFileW,LoadLibraryW,FindClose,FindResourceW,LoadLibraryW,	13_2_6A172A30
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A162470 FindClose,FindFirstFileW,FindFirstFileW,	13_2_6A162470

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Code function: 11_2_04360366 GetSystemInfo,

11_2_04360366

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: TDService.exe, 0000000B.00000002.172697739091.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/>
Source: TDService.exe, 0000000B.00000002.172697739091.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.Data.Common.D

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	API call chain: ExitProcess graph end node			graph_4-23094
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	API call chain: ExitProcess graph end node			graph_13-37103

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_00423B3C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_00423B3C

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_00425561 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00425561

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_004240E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004240E4
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00424945 SetUnhandledExceptionFilter,	3_2_00424945
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00423B3C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00423B3C
Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: 3_2_00420DEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00420DEF
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA46CD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6DA46CD8
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA45A8A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6DA45A8A
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: 4_2_6DA451C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6DA451C7
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001B723 SetUnhandledExceptionFilter,	13_2_1001B723
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_1001B735 SetUnhandledExceptionFilter,	13_2_1001B735
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A175A8A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_6A175A8A
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A176CD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_6A176CD8
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: 13_2_6A1751C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_6A1751C7

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Process created: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe "C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK1.cer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -f -addstore TrustedPublisher TK2.cer

Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProgmanU
Source: 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\8ue90oYkrv.exe	Code function: GetLocaleInfoA,	3_2_004295EA
Source: C:\ProgramData\miaE9AF.tmp\TDService.exe	Code function: GetLocaleInfoA,	4_2_6DA4DEDB
Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe	Code function: GetLocaleInfoA,	13_2_6A17DEDB

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.cat VolumeInformation

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_004250BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_004250BC

Source: C:\Users\user\Desktop\8ue90oYkrv.exe

Code function: 3_2_0041F2D0 MessageBoxW,CoInitialize,GetVersionExW,GetCommandLineW,MessageBoxW,MessageBoxW,MessageBoxW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateProcessW,GetLastError,CloseHandle,WaitForSingleObject,GetExitCodeProcess,FindCloseChangeNotification,SetCurrentDirectoryW,SetCurrentDirectoryW,

3_2_0041F2D0

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Windows\System32\certutil.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\B6E6CB217307F0D3CD5CA360D368887B8FA98BA3 Blob

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0142B97E listen,	11_2_0142B97E
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0142B940 listen,	11_2_0142B940
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_0436164A bind,	11_2_0436164A
Source: C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	Code function: 11_2_04361627 bind,	11_2_04361627

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	2 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	23 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	23 Windows Service	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	43 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
8ue90oYkrv.exe	4%	ReversingLabs
8ue90oYkrv.exe	1%	Virustotal	Browse
8ue90oYkrv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	100%	Joe Sandbox ML
161fe34.rbf (copy)	2%	ReversingLabs
161fe34.rbf (copy)	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	2%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	2%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe	6%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe	1%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe	10%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	5%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe	8%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll	0%	Virustotal	Browse
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	0%	ReversingLabs
C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys	0%	Virustotal	Browse
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	0%	ReversingLabs
C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.installaware.com/buydirect.aspopen	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/L	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TechkonDriver64Bit.7zipiJ	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TECHKON	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/UploadReport2	0%	Avira URL Cloud	safe
HTTP://WWW.TECHKON.COM/MICROSOFT	0%	Avira URL Cloud	safe
http://www.installaware.com/buydirect.aspopen	1%	Virustotal		Browse
http://www.smartassembly.com/webservices/Reporting/L	1%	Virustotal		Browse
http://www.installaware.comz	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TECHKON	0%	Virustotal		Browse
http://www.installaware.com/InstallAware	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/Reporting/UploadReport2	0%	Virustotal		Browse
http://www.techkon.com/	0%	Avira URL Cloud	safe
http://www.installaware.com/	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TechkonDriver64Bit.7zip	0%	Avira URL Cloud	safe
http://www.installaware.com/InstallAware	1%	Virustotal		Browse
http://www.techkon.com/	0%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/	0%	Avira URL Cloud	safe
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	0%	Avira URL Cloud	safe
http://www.installaware.com/x2/	0%	Avira URL Cloud	safe
http://www.mywebsite.com/TechkonDriver64Bit.7zipn	0%	Avira URL Cloud	safe
http://www.installaware.com/x2/	1%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/	0%	Virustotal		Browse
http://www.installaware.com/	0%	Virustotal		Browse
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	0%	Virustotal		Browse
http://www.mywebsite.com/TechkonDriver64Bit.7zip	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.thawte.com/ThawteTimestampingCA.crl0	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mywebsite.com/TECHKON	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.168283345562.0000000002908000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F940000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.smartassembly.com/webservices/Reporting/L	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mywebsite.com/TechkonDriver64Bit.7zipiJ	TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.000000000336F000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.com/buydirect.aspopen	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sawebservice.red-gate.com/	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2008/schema.xsd	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.smartassembly.com/webservices/Reporting/UploadReport2	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
HTTP://WWW.TECHKON.COM/MICROSOFT	TDService.exe, 00000004.00000003.168283345562.00000000028DB000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.comz	8ue90oYkrv.exe, 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167929283940.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167626091802.00000000007FF000.00000002.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.168281434764.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000002.168290671231.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000002.168278210797.0000000000440000.00000002.00000001.01000000.0000000D.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167699894798.000000007FE3A000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000000.167698325162.000000000095B000.00000002.00000001.01000000.0000000E.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.000000000345C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.installaware.com/InstallAware	TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_me	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.techkon.com/	TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.00000000028B4000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.00000000033E2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.installaware.com/	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.0000000000418000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F957000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002AD9000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mywebsite.com/TechkonDriver64Bit.7zip	TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167699894798.000000007F940000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000D.00000003.167729039334.00000000033E2000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.smartassembly.com/webservices/UploadReportLogin/	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, 8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.installaware.com/x2/	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000000.167625105498.000000000077E000.00000020.00000001.01000000.00000005.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007FCBD000.00000004.00001000.00020000.00000000.sdmp, TechkonDriver64Bit.exe, 0000000C.00000003.167693420796.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.techkon.com/Microsoft	8ue90oYkrv.exe, 00000003.00000003.167616320182.0000000003284000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167673031660.00000000032E1000.00000004.00000020.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.167629272682.000000007F940000.00000004.00001000.00020000.00000000.sdmp, TDService.exe, 00000004.00000003.168283345562.00000000028DB000.00000004.00001000.00020000.00000000.sdmp	false		unknown
HTTP://WWW.MYWEBSITE.COM/TECHKONDRIVER64BIT.7ZIP	TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl	drvinst.exe, 00000017.00000003.167837015987.000001E13D4CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mywebsite.com/TechkonDriver64Bit.7zipn	TechkonDriver64Bit.exe, 0000000D.00000003.168267103771.0000000002804000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408892
Start date and time:	2024-03-14 12:27:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8ue90oYkrv.exe
Detection:	MAL
Classification:	mal45.evad.winEXE@63/343@0/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 67% Number of executed functions: 203 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, x1.c.lencr.org
Execution Graph export aborted for target TechkonDriver64Bit.exe, PID 3060 because there are no executed function
Execution Graph export aborted for target x64DPInst.exe, PID 4736 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:30:07	API Interceptor	28630989x Sleep call for process: TDService.exe modified

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Config.Msi\161fe33.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34388
Entropy (8bit):	5.157244558511727
Encrypted:	false
SSDEEP:	768:PyTwT115cmcDdWW3pv2ltwuNDJLpt7t7t7t7t7t7t7t7t6t7tdt7t3JdezBwi8S/:qTo115cmcDdWW3pv2ltwuNDcA
MD5:	BB950D871CB6A8BD28656BDD80FA8551
SHA1:	C6696E6B18250DDBDC4281DDC90F87D42BEA73CC
SHA-256:	77E822749D3CED1D3110A1BFF335948C899D25C1A97ED1FF73D2B594FC50236E
SHA-512:	85DAFDA9893A3EB7824F67C338F10E2F38D1AB74D50562B31076FB745C8C5E3AD8356A1488C380B4A1159EB9C111E19E054C2140FA98C72C8E1340BB7F662252
Malicious:	false
Preview:	...@IXOS.@.....@.cnX.@.....@.....@.....@.....@.....@......&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}..TECHKON Device Service..TDService.msi.@.....@.....@.....@........\PROGRA~3\&.{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Service......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{CD0C69EF-2B12-47ED-87B7-5A1DB20CBCD9}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{4D6F449F-FA68-42B5-A305-16C45F308B8F}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{96ED6BF5-4AA1-4668-AEEE-E5101CDF29BA}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{672A692B-629D-4B2A-A63B-2E211EA7164C}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{877EEC96-C1A3-45AB-B6E1-782150290E44}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{C166FAF3-5D3D-41C9-B181-43DF2464FB59}&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}.@......&.{1E484634-B892-4CBA-9690-0E

C:\Config.Msi\161fe38.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	46700
Entropy (8bit):	5.127097765622923
Encrypted:	false
SSDEEP:	768:z9Lc5CLgpPGZvWs5idXxqlcsS8/4r/RmBkE/l/83tOtatNtWtdtAtstSthtkt7t9:ZLc5CLgpPGZvWs5idXxqlcsS8/4r/RmX
MD5:	FC1AF9DC8692F81A790B92111E924E58
SHA1:	FD18FB43C2FEAF4F070966F9C47163E61330EFCF
SHA-256:	F2A8E8ECCBDB10D04D6908CAB0E69F41E40709B72825314DA0A6FBF60E92CE1B
SHA-512:	B96F71E07857332B80DA6CDDC5E0DA50CF2398649BB6E9B1748351DDBD7151ABA4206650B9B07E9D9E0C2ABBAEAE551FC3524B6AD7024C34D6EC82C9C4799D9E
Malicious:	false
Preview:	...@IXOS.@.....@.cnX.@.....@.....@.....@.....@.....@......&.{55EA8940-B618-47BD-A642-20BFB2A64F78}..TECHKON Device Driver 64Bit..TechkonDriver64Bit.msi.@.....@.....@.....@........\PROGRA~3\&.{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Driver 64Bit......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{5702EAC5-033D-48B5-B83F-DEF9ECF4C262}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{52B0046B-434A-4EA9-9AC7-766C93D4D3F6}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{6D03A36D-9750-4B1E-8344-0CE7ACED2DE2}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{2B8BCB22-4191-4BD5-817D-B0123E06B87F}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{2CBD538B-C017-439A-8339-57F7ED6A8246}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{CDF804F9-6941-49E0-8B67-519B61E33E8A}&.{55EA8940-B618-47BD-A642-20BFB2A64F78}.@......&.{DB88E18

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2871552
Entropy (8bit):	7.91890094076526
Encrypted:	false
SSDEEP:	49152:NnnZhJegT3345UB8r/fecnYWgPmGWy0tGGDOYEHamRS1j1fC5j9IXvWm6BPX:5nZygT33wtr/fmZxWywGGDOBxRkj1f6x
MD5:	3A0BF599146750C008BA6960C694470D
SHA1:	22E869B8C60BBFB263A7AF2B5350386617EB6E72
SHA-256:	3F1DC61B0BF0B93B1CD5478F151895B357DA92CAD2A48857E2FC4645C41E2DA3
SHA-512:	5E6ED7829C8DC1879C67FF6F142A96575251C583A5AE9103A48587BFF42C463B59B5EAB7F543414838AEA4E5BBCA6C0F8433CE3BEF6367632B663F242DF7D30F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@...................................+......................................`......................+. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2902256
Entropy (8bit):	7.920111663334885
Encrypted:	false
SSDEEP:	49152:ynnZhJevas/0bxZjXAqySgkyneVSTTHJ7Als2GT/R1OPS5R+dQ:4nZA2xZjXgkAMSH24t1L5R+dQ
MD5:	F6CD94DEAEA55BB414650D6A9CB7DD6C
SHA1:	06AC62B0283E0490C9F66D3DE1E5CA47866CA3AA
SHA-256:	08F2DBAF4537368977DC0F0790F1FFF6FD65D30F4C91FED2B2CACC9A7F307A07
SHA-512:	3688F2622F43570DC1BD53B027D9A6C57FDE7DD4A34697D2E283549CF780F789A033FAA6EF5AB20EA49551921AC71844407AAAD0EDC87F9AAC9D1C2413D58F2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@..................................$-......................................`....................../,. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	7.783380196730505
Encrypted:	false
SSDEEP:	24576:vF2oerN+CFfmxlJHLjyyrRyx/tCA1Q49UMEEXEimWZ2Eoxch6YB4:Mz9FOLjyywxNbrEEXhFoxch3
MD5:	0B682718F2229F8526387698D1F60DAF
SHA1:	FD7A024C14B1874587B1C6F94ED8AE4BA55C385C
SHA-256:	2491D1F5D96A265794972F7BAB6173005B300BC1E85ACDA346E882D6DEBB366A
SHA-512:	2D3B801A91C92DEC134AB0A81D7CFD2ADDA1045FD0A706B2605CB3046BEB19D97DD49D4A1418CA4966EDAE91A6CDB10A21379B85E1C035C20FB1FCE14851E597
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W.....................`......\|.... ........@.. .......................`............@.................................2...J.......P@...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...P@.......P..................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	4.824855858394781
Encrypted:	false
SSDEEP:	24:cPN97KgwMV+nCGgMSqX+nH1WqBN3kmugmC4mA0snxs5XFF:cPr7/wdCGgXHH1Wqfi5mA0sxsvF
MD5:	83B25C1067C9BE0BCDF289BBED80D363
SHA1:	25FABE1F042D90F5678C3F97FCA6260BF27619D5
SHA-256:	1AB2F18023EE11A92E4A3D5D7F5A9FB9A8ED8D69D93D8D804CCCEB1E431A2442
SHA-512:	FCA4C27E0FDEAD9537694168AEA7DF3F2A05FB8E05F3EA8ECC6241E8A16A801532C9F71C777AC16528747D2160B1C9B5898CB5B8AF6C751509BE296F0CF280C0
Malicious:	false
Preview:	.<configuration>...<configSections>....<section name="log4net" type="System.Configuration.IgnoreSectionHandler" />...</configSections>...<runtime>...</runtime>...<log4net>....<appender name="TraceAppender" type="log4net.Appender.TraceAppender">.....<layout type="log4net.Layout.PatternLayout">......<conversionPattern value="%date [%thread] %-5level- %message%newline" />.....</layout>....</appender>.. .. <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="TDServiceLog.txt" />.. <appendToFile value="true" />.. <rollingStyle value="Size" />.. <maxSizeRollBackups value="10" />.. <maximumFileSize value="100KB" />.. <staticLogFileName value="true" />.. <threshold value="INFO"/>.. <lockingModel type="log4net.Appender.FileAppender+MinimalLock" />.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.368242915265491
Encrypted:	false
SSDEEP:	192:kRYqGL5n0f1auFrzr9VCj0aWSXRaf4iPH0uTiF7odzFaGFbieHr/zZYZud:37l08kCBZBaf9/BiqzFdFbieHTzZYcd
MD5:	10195658250CA94B280DECCB4997B198
SHA1:	765684257978376B463369065C552366282963F3
SHA-256:	6801FD3462EE096A683D97A65D6E421E8B1419E9EEDC4A47BE7E2A14BCFA2CEF
SHA-512:	016207696A3D7E4D719F3506F5C6F5CF66B77C56226778C328A0A0D6D807D572650CC460A9343276A05F2448BBC16EF0F8DF844BA257ECF8573C48343F6A0B36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..W...........!.....0... ......^N... ...`....@.. ...............................L....@..................................N..W....`..h...........................XM............................................... ............... ..H............text...d.... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9261380700304658
Encrypted:	false
SSDEEP:	384:GJzxPeOGEk4GKz7csqunx2gs1RteTOJ722RELbcAbZtLWs8:EzxNksqaJr2SLIEZ
MD5:	9CFAB4DAACA85482012D97693EA88201
SHA1:	095C31E6257CC5028E4605266477526D3B256B2B
SHA-256:	0EBB561BC5FB6FEB35ADE2BE679AB8149C9942253ADD9A1C2B7A6F53ADFE4E46
SHA-512:	9B6587CE414365420E96CA430C8DE170006CFF9ACEB51E7BF95BBFF6845AA936E8BF35D30B6442D23D48B460A085FA47673959BD3CB996970894549A71B7AB9F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..W.................P...P......^e... ........@.. ....................................@..................................e..S........?..........................\d............................................... ............... ..H............text...dE... ...P.................. ..`.rsrc....?.......@...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.88327202760358
Encrypted:	false
SSDEEP:	49152:8t723QiNn1X9NVWevTX9giFzbmjEanZQTS:8k3QiNnjNVWeLNg6nmj9n
MD5:	819E58177441A1A5EAEE35216DC4B6D7
SHA1:	65306A7FEF4AC738EA7177833B1D966E0B6C0BA5
SHA-256:	2E03F7A87D69FE8B32A0B9604E270A3AF9DD3421351BE230889B7E24F2F6F88C
SHA-512:	D8B7D560364D348ABFD956ACA24EC5631AB7488E3D49C27256B829D4EA165E0C56DC579E2E0EF1209029B7559B16A401AE63CDBBB2C773DAC176D7ABBAA3823A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 10%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. ....................................@.................................h...J.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	7.835247620836694
Encrypted:	false
SSDEEP:	24576:foVuryMKftmxBFAsBnnJO16noCKPxKnp:gVoyMKftoYsFnI1DRPU
MD5:	6E5F4B906BD48CB77E3830F2871F726E
SHA1:	7C070D83CAD9F33D4A9EC01CDE9E0BB3AFE51409
SHA-256:	6DD53DECDE4A70E8B42657FAE088C22C07D8553E59506524ABA608BA087066F1
SHA-512:	616B153C677FE7F403D179664E24AD5FCD6041237A9A2A9FC4CA0A2C8B0050E74AA953E7349EC23780485D7D4984AA5072A8CCA26CDF9BC8439981424CC46C32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 8%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. .......................@............@.................................X...J............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18285
Entropy (8bit):	3.2625513904435572
Encrypted:	false
SSDEEP:	384:Lgxt0XdZ+3rWJr1N684b86fZMaTx111m+0:QiM3Q13A6aN111c
MD5:	1EBA2DF49DE0B85065585C6042C0770B
SHA1:	FE847BFA3FA1DC279BF7FDCB62BC27EFD4306B91
SHA-256:	BD0732871DBEAEE6A3BD9D5D0C5E1A32CB3752A857D203857AE2A99780004232
SHA-512:	17CA2455054057A486EA2D77439CFFCE4AFC4564E99219AAE7BB44DAE0511F552D8DC5C071A8FA01CDE208EE36EADD90600DE9976FC9CA31CE6310FDD448A005
Malicious:	false
Preview:	Remission..16.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..17.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..18.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..19.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..20.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..21.0,212.0,21.0,21.0,211.0,213.0,217.0,22.0,224.0,227.0,228

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	3.6044727088231916
Encrypted:	false
SSDEEP:	96:IPGiqjELGICWPCVo61VAZ1MluVPKEb81H:IPooLGICBVo6Oc
MD5:	55B6DFD4BEE7501D0A45D4BA9A865C06
SHA1:	8D4395E23F830F37FB59FBC8A03D15753E89F65F
SHA-256:	BE03976E9EB14CD5C07E3B7B0C7AD26B637F3AFC765959D080EE91BAD095B513
SHA-512:	63B07E67AAAAAB735967651AD1B3B8FC960F2809C02AF8DADD01BBEA9A722E56AA1C0BF8E95185965B919757DB6B3E5E5EB66CB3ED555416B755142D1D6E89AC
Malicious:	false
Preview:	Remission..Black.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..Cyan.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..Magenta.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..Yellow.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..Black_SD90.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..Black_SD0.0,212.0,21.0,21.0,211.0,213

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.22180183473209
Encrypted:	false
SSDEEP:	6144:WNO7HqL+9Qxpw1Lpaofbn+0u61wxkM2AbuACH9d7jWy:WNO7HJX16uph
MD5:	5D1E5758CEE95AC926D0C9F7C18095EE
SHA1:	8253C41EF9539BDAD5FC15DB4FABA99C23242CD2
SHA-256:	4E48950BB961EA13C4DD489D915D0DF83304D52C950A99E3E6B981EAC22112D9
SHA-512:	B074D0DE952407F5DC721DE7157EC9957A8AD98A9C04F27F04A7BA81B5F0064DEB93F8D370539A4D37598E95B9D1EC5F91B13AFEC26BBA04309138E03F763750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^W...6...6...6..a...6..u)...6.....6..u)..S6.......6..>...6...6..6.......6...0...6.......6..Rich.6..........PE..L.../l.?...........!................9................................................................'..............`...........d...............................x.......................................................x............................text............................... ..`.rdata........... ..................@..@.data....t.......p..................@....rsrc...............................@..@.reloc.. ".......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dznet.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.191530389320213
Encrypted:	false
SSDEEP:	768:idEKqzhqGRvl2ZTDATBSNdCskYW50dstrF/vmifdXJNs7GGSZhRhudUrvf:idErzhqGNl2dATskYgLhfhC2vf
MD5:	2B3281E100D19123A8E307FBB2DB0939
SHA1:	501376281A00B9B9A90BE2F7DACA3DB87C96DCC0
SHA-256:	24C362E5E8819F46C23DF1D2C36C5343D088293AF4178D9ED8B966296F0BB43E
SHA-512:	3ACB639C1C0AAB53EE9FDCB3E5F9C3767F70536858D96EBEE7841567C7C1C130F5D8DFB6FF6F491B17A56B3D579C2545E8909B3C2EB5D6D5947FEA1D6C15045A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.?...........!......... ........... ........... ....................... ......"...........................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.2832136787344055
Encrypted:	false
SSDEEP:	3:HrJQyogRM/fyAiLJQyogRM/cLGr:HeFT9b
MD5:	C10BB4CF9692695632DE53434201ACA9
SHA1:	4215207F1C5E53C2CBA1638C7B27B587F0E48FC6
SHA-256:	CC11C5FEA0D555905CC67BF2081C55F9F82A049EE65A89A371D2310BF37AA8EB
SHA-512:	27234743327A5F7F46B60CD1F544C77353AA93C29E583EE8A8DB801D5E654EEDB2AAF30F8F4EA4219BB53B739C9E51694143009F9533BB456F0B44F2E2ADC862
Malicious:	false
Preview:	certutil -f -addstore TrustedPublisher TK1.cer..certutil -f -addstore TrustedPublisher TK2.cer..

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK1.cer

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.164821094442024
Encrypted:	false
SSDEEP:	24:3hE3IaffyrWghhywWGwBBrG7V+vXx9uyv1jTRgjDiuVz0mkhfAwfSLC:36DffrgarB8V+vXx9uyv0DiuVxkhfEm
MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
SHA1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
SHA-512:	7232D3260D6714B6DD1B403AB1F838E2D6A33F9AA37D50C2DE4328DBFEA450C3A77875A333968219CB4F8B21140559310FBA42C9833F740A928554387EFFD969
Malicious:	false
Preview:	0.._0..G.......,h..g.0L.....1..0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140304000000Z..170602235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........!.`.x..qr.r.....y.....$<.]./..E.EyJ.&4..}....}Y.O..5up....77.B.E,.U..P..b@.T.Ek..mr_9#.?.n..S....^?j....Z....m8.....L+..n...s.....k.......<\|>_.T9.C...u.S}N...3.C.oKqup>..?`,..U.."..p..3<d<..$Q....\|_...`U.(m...f...j....+-.. F`.....[..e\|..g.?5........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....0*0(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\TK2.cer

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.175302981793894
Encrypted:	false
SSDEEP:	24:/3IaffyrW+hywWGwBBrG7pLqQ9xtRgjDiuVz0mkh6fyzjOlJ9X2I0:/DffrJrB80mgDiuVxkh6fyzSx0
MD5:	1E256F3CD8A847D91596BF2C37DBF285
SHA1:	6641ED279EF1A7A8E6D06BCEB38570B429101AA2
SHA-256:	6FCE0715E8C7D2B5BF2D7B049AE6CB6842E2D9757A2D9296A1587BBD05C2FE25
SHA-512:	91DAD8AFEA4A493269688CA7B7642DA7A663742C5811AADB3EE13D66DCB3BE2B1ED5EA6A9F45FBF9E6E432AEED0A9AE1AAA4A921658F2D5DDF2524C5EF195C3A
Malicious:	false
Preview:	0.._0..G.......7......'@...\...0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...110320000000Z..120307235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........6.....:N~lw..F..J7h...5x._9..\....:.)z..].......g.....4.....D..FI.......s....`L....}..`~.U..E.H....Q........sv.....x.eLh...`..<^.%.. .J.....(5...^.....U.P.....r.......{..u...O..0....V.y......$#...#. N..:...E.L0.CZ..B3.E..@x.?.\|..B.".....&.<.........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....00(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\DENS\dens_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\MF-IR\spectrodens_ir_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDriveWLan\spectrodrive_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDrive\spectrodrive_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet2\spectrojet_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroJet\spectrojet_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroPlate\spectroplate_x64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5299123
Entropy (8bit):	6.417889890443472
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJk:hTaRZ8tjD4+wD5ZksyPHIFIk
MD5:	5A3DA2206BD35C381B826FF748093684
SHA1:	AE5A7D9CEB4324BCE26B6E2ED7C1FE18DEAF917E
SHA-256:	E94B30CF6F7FA8F30EB21B5A4B3316B5F005321C31A2139095882450D8BF8C78
SHA-512:	DBA818B5E442EA797E4F20F313C2196BA366DE82784968A1F2F29C8F3AAEE5BC09B7B9CC33A959C0E2507F31517E32D48C118CDE5119A741C5378DCF29856801
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.msi

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.res

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3821599
Entropy (8bit):	6.2872927335703555
Encrypted:	false
SSDEEP:	49152:YXlXDzXmLXrXxXzX4XOXWXmOX+rX14rFRMSigFEkEi24EJD2d8hMcSCnmNPIkFVT:cTE94w4BF5
MD5:	839619AB3C498F9119516797217ECE8B
SHA1:	83593C1247452E23F900E2F383B80FCE222E77D5
SHA-256:	C0BA92E82179F99A6CBAE6B26E2CF94DA86D9C2A89FC71552484150D4FB1A237
SHA-512:	8947009EE28BD4A8D6C2BEE4B03474A981A28C789021B31C6B3010FD0727180F16D7FE95F35DE13A533CA56953DE37CC088F496FA82CD4FA0371B9D422C79816
Malicious:	false
Preview:	7z..'...P=".'H:..............oB....TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\miaB21.tmp\data\OFFLINE\150AC403\DFC33D3E\spectrodens_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\15F69ECD\C2555B5\spectrojet_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\1A9DA512\CFFA0AE5\spectroplate_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\1ABF3862\DFC33D3E\spectrodens_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\ProgramData\miaB21.tmp\data\OFFLINE\4D56F533\BD12AE78\spectrodens_ir_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\ProgramData\miaB21.tmp\data\OFFLINE\4F27760E\BD12AE78\spectrodens_ir_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\502E833A\9B44F18F\spectrodrive_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\52B152B3\9B44F18F\spectrodrive_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\ProgramData\miaB21.tmp\data\OFFLINE\56A7DD7A\5EDECBEE\spectrojet_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\ProgramData\miaB21.tmp\data\OFFLINE\5809A5D8\5EDECBEE\spectrojet_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\66980B9F\9C4070E9\dens_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\66E41FEB\A1D4A3D9\TK1.cer

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.164821094442024
Encrypted:	false
SSDEEP:	24:3hE3IaffyrWghhywWGwBBrG7V+vXx9uyv1jTRgjDiuVz0mkhfAwfSLC:36DffrgarB8V+vXx9uyv0DiuVxkhfEm
MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
SHA1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
SHA-512:	7232D3260D6714B6DD1B403AB1F838E2D6A33F9AA37D50C2DE4328DBFEA450C3A77875A333968219CB4F8B21140559310FBA42C9833F740A928554387EFFD969
Malicious:	false
Preview:	0.._0..G.......,h..g.0L.....1..0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140304000000Z..170602235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........!.`.x..qr.r.....y.....$<.]./..E.EyJ.&4..}....}Y.O..5up....77.B.E,.U..P..b@.T.Ek..mr_9#.?.n..S....^?j....Z....m8.....L+..n...s.....k.......<\|>_.T9.C...u.S}N...3.C.oKqup>..?`,..U.."..p..3<d<..$Q....\|_...`U.(m...f...j....+-.. F`.....[..e\|..g.?5........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....0*0(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\ProgramData\miaB21.tmp\data\OFFLINE\76FCA102\DFC33D3E\spectrodens_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\7AA455DC\9C4070E9\dens_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\ProgramData\miaB21.tmp\data\OFFLINE\849003A2\CFFA0AE5\spectroplate_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\ProgramData\miaB21.tmp\data\OFFLINE\84FEA59D\CFFA0AE5\spectroplate_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\9167C40A\C2555B5\spectrojet_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\94312164\5EDECBEE\spectrojet_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\98500B5D\BD12AE78\spectrodens_ir_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\9E7D6EA9\A1D4A3D9\TK2.cer

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	7.175302981793894
Encrypted:	false
SSDEEP:	24:/3IaffyrW+hywWGwBBrG7pLqQ9xtRgjDiuVz0mkh6fyzjOlJ9X2I0:/DffrJrB80mgDiuVxkh6fyzSx0
MD5:	1E256F3CD8A847D91596BF2C37DBF285
SHA1:	6641ED279EF1A7A8E6D06BCEB38570B429101AA2
SHA-256:	6FCE0715E8C7D2B5BF2D7B049AE6CB6842E2D9757A2D9296A1587BBD05C2FE25
SHA-512:	91DAD8AFEA4A493269688CA7B7642DA7A663742C5811AADB3EE13D66DCB3BE2B1ED5EA6A9F45FBF9E6E432AEED0A9AE1AAA4A921658F2D5DDF2524C5EF195C3A
Malicious:	false
Preview:	0.._0..G.......7......'@...\...0....H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://www.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...110320000000Z..120307235959Z0..1.0...U....DE1.0...U....Hessen1.0...U....Koenigstein1.0...U....TECHKON GmbH1>0<..U...5Digital ID Class 3 - Microsoft Software Validation v21.0...U....TECHKON GmbH0.."0....H.............0..........6.....:N~lw..F..J7h...5x._9..\....:.)z..].......g.....4.....D..FI.......s....`L....}..`~.U..E.H....Q........sv.....x.eLh...`..<^.%.. .J.....(5...^.....U.P.....r.......{..u...O..0....V.y......$#...#. N..:...E.L0.CZ..B3.E..@x.?.\|..B.".....&.<.........{0..w0...U....0.0...U...........0@..U...90705.3.1./http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D..U. .=0;09..`.H...E....00(..+.........https://www.verisign.com/rpa0...U.%..0...+.......0q..+........e0c0$..+.....0...http://ocsp.verisign.com0;..+.....0../http://csc3-2010-aia

C:\ProgramData\miaB21.tmp\data\OFFLINE\B06B5044\C2555B5\spectrojet_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\ProgramData\miaB21.tmp\data\OFFLINE\B258770\A1D4A3D9\Cert.Bat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.2832136787344055
Encrypted:	false
SSDEEP:	3:HrJQyogRM/fyAiLJQyogRM/cLGr:HeFT9b
MD5:	C10BB4CF9692695632DE53434201ACA9
SHA1:	4215207F1C5E53C2CBA1638C7B27B587F0E48FC6
SHA-256:	CC11C5FEA0D555905CC67BF2081C55F9F82A049EE65A89A371D2310BF37AA8EB
SHA-512:	27234743327A5F7F46B60CD1F544C77353AA93C29E583EE8A8DB801D5E654EEDB2AAF30F8F4EA4219BB53B739C9E51694143009F9533BB456F0B44F2E2ADC862
Malicious:	false
Preview:	certutil -f -addstore TrustedPublisher TK1.cer..certutil -f -addstore TrustedPublisher TK2.cer..

C:\ProgramData\miaB21.tmp\data\OFFLINE\C0AC9330\383AE05B\spectrodrive_x64.sys

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\CE56FB43\9B44F18F\spectrodrive_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\E09F5A5F\383AE05B\spectrodrive_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\E1318D92\9C4070E9\dens_x64.inf

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\ProgramData\miaB21.tmp\data\OFFLINE\F2F92670\383AE05B\spectrodrive_x64.cat

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\mDIFxEXE.dll

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1316352
Entropy (8bit):	6.662123826541052
Encrypted:	false
SSDEEP:	24576:htJHEI7Kl/eZfZblU8u+noMRBqSPSUO9z8mF36X+huHcN2:rkl6PoMRMSSzy+hwcN2
MD5:	595209D10BD0EC1B01F8AC31195E7902
SHA1:	849F59A743DE094C7CF05C7F89B0ED22309B619C
SHA-256:	8D67E430AB5300BBA92B1D1B45D2E87C13E8B0D61A75D02A70BC203696430534
SHA-512:	3AA7C32A3BC9F0A1E5D4B67B657A216131FBDD62E5794403D01FBBCA663420D861460DAEA6ECEA6F2C4268E67B1E2A71DEDE6E6A57FF041E34BFD3F3130EC328
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...X..V.....................j.....................Q....................................................................O........5.......T.............................................................................H.......^....................text...h........................... ..`.itext..T........................... ..`.data....M.......N..................@....bss....TS... ...........................idata...5.......6..................@....didata.^............0..............@....edata..O............:..............@..@.rdata...............<..............@..@.reloc...............>..............@..B.rsrc....T.......T..................@..@....................................@..@........................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\mDIFxIDE.dll\x64DPInst.exe

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1050104
Entropy (8bit):	5.617498652730841
Encrypted:	false
SSDEEP:	12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
MD5:	BE3C79033FA8302002D9D3A6752F2263
SHA1:	A01147731F2E500282ECA5ECE149BCC5423B59D6
SHA-256:	181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
SHA-512:	77097F220CC6D22112B314D3E42B6EEDB9CCD72BEB655B34656326C2C63FB9209977DDAC20E9C53C4EC7CCC8EA6910F400F050F4B0CB98C9F42F89617965AAEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m.......%...........................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaB21.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\ProgramData\miaB21.tmp\data\TechkonDriver64Bit.msi

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\miaB21.tmp\mia.lib

Download File

Process:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5295078
Entropy (8bit):	6.41595061147608
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJF:hTaRZ8tjD4+wD5ZksyPHIFIF
MD5:	A94A3D60FA8A54AB71ABED39D5883D86
SHA1:	3FC14B383FD699017AA7B7281C28F143AEAF7B9F
SHA-256:	3AC4616A5ABF9A408EDCCC48D15AB9DD6441DAD273C8F477C1EB291812949451
SHA-512:	172CE336A3343D8ED92EDA525A549F1E388D37076F71DC28C043FABC94B04761B7E936871F203C2B681EB4BFCC8C239327656F51003CD46D11C94589B1E8CC13
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaE9AF.tmp\TDService.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\miaE9AF.tmp\TDService.msi

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\miaE9AF.tmp\TDService.res

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3831837
Entropy (8bit):	6.288047394335939
Encrypted:	false
SSDEEP:	49152:zXlXDzXmLXrXxXzX4XOXWXmOX+rXAEJD2d8hMcSCnmNPIkFVZ+cocaFjhkSYKPM:xw4BF3ai
MD5:	3EA26D5D84024858345551BDD209F62A
SHA1:	DE89AEAB1CBE1328B0CDB7C17BE2B43BEA076E30
SHA-256:	E58F0C20DFFBB1299D972CC7C3556DDDDE8D6888570FEEF208E48EAD68877149
SHA-512:	5E8F2CCA528F77CC624FD17228D796E3921008A9D73511793E33FE6F4B94463D5304A969A4F18DD0BCDD2C5B0663861570E861DAC58355EF641860BB071AE607
Malicious:	false
Preview:	7z..'.......'p:...............M...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1872974D\9EB13253\TechkonDriver64Bit.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2902256
Entropy (8bit):	7.920111663334885
Encrypted:	false
SSDEEP:	49152:ynnZhJevas/0bxZjXAqySgkyneVSTTHJ7Als2GT/R1OPS5R+dQ:4nZA2xZjXgkAMSH24t1L5R+dQ
MD5:	F6CD94DEAEA55BB414650D6A9CB7DD6C
SHA1:	06AC62B0283E0490C9F66D3DE1E5CA47866CA3AA
SHA-256:	08F2DBAF4537368977DC0F0790F1FFF6FD65D30F4C91FED2B2CACC9A7F307A07
SHA-512:	3688F2622F43570DC1BD53B027D9A6C57FDE7DD4A34697D2E283549CF780F789A033FAA6EF5AB20EA49551921AC71844407AAAD0EDC87F9AAC9D1C2413D58F2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@..................................$-......................................`....................../,. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\1A2661C4\F965E9F6\USBIOCOM.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.031963137664287
Encrypted:	false
SSDEEP:	3072:LwlZ+P6imnm8mFmT73tgHnV53kAgcvzgRm1trohJkwh:cZ+6imnm8mFmT73krb6gonf
MD5:	CEC1791BEC45F9D86771AF4F24EAA3F4
SHA1:	1B806C9A7189C7801EF643C5AEA03CD6B0DEDCC4
SHA-256:	7878EB862C0A8AB0766236E6C2183FAC93A0C734276347A143B454E2FB8B4F58
SHA-512:	BF917BA4C20DB97685A4BFEA266ECE11C77286F9480E546007FC1D830E4DFBA0966F6B5B59D74AFC89713276BB899755DFABC8F3C42A8422E612401C761A9BE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.v.v.v.Y.v.v.Y.v...v"..v.v"..v.v.vE..v.Y.v..v.Y.v...v.Y.v...v.Y.v...vRich.v........PE..L...Q..K...........!.....`...P...............p......................................[...............................0................0..................................................................@............p..l............................text...._.......`.................. ..`.rdata...x...p.......p..............@..@.data....9....... ..................@....rsrc........0......................@..@.reloc..V'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\25D64044\E98CA0F\TDServerApp.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1253376
Entropy (8bit):	7.783380196730505
Encrypted:	false
SSDEEP:	24576:vF2oerN+CFfmxlJHLjyyrRyx/tCA1Q49UMEEXEimWZ2Eoxch6YB4:Mz9FOLjyywxNbrEEXhFoxch3
MD5:	0B682718F2229F8526387698D1F60DAF
SHA1:	FD7A024C14B1874587B1C6F94ED8AE4BA55C385C
SHA-256:	2491D1F5D96A265794972F7BAB6173005B300BC1E85ACDA346E882D6DEBB366A
SHA-512:	2D3B801A91C92DEC134AB0A81D7CFD2ADDA1045FD0A706B2605CB3046BEB19D97DD49D4A1418CA4966EDAE91A6CDB10A21379B85E1C035C20FB1FCE14851E597
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W.....................`......\|.... ........@.. .......................`............@.................................2...J.......P@...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...P@.......P..................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3476C065\CC63C202\TDServiceConnection.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.368242915265491
Encrypted:	false
SSDEEP:	192:kRYqGL5n0f1auFrzr9VCj0aWSXRaf4iPH0uTiF7odzFaGFbieHr/zZYZud:37l08kCBZBaf9/BiqzFdFbieHTzZYcd
MD5:	10195658250CA94B280DECCB4997B198
SHA1:	765684257978376B463369065C552366282963F3
SHA-256:	6801FD3462EE096A683D97A65D6E421E8B1419E9EEDC4A47BE7E2A14BCFA2CEF
SHA-512:	016207696A3D7E4D719F3506F5C6F5CF66B77C56226778C328A0A0D6D807D572650CC460A9343276A05F2448BBC16EF0F8DF844BA257ECF8573C48343F6A0B36
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..W...........!.....0... ......^N... ...`....@.. ...............................L....@..................................N..W....`..h...........................XM............................................... ............... ..H............text...d.... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\34E6DE3C\FDA73152\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3CE6DECE\FDA73152\defaultSpot.tss

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	3.6044727088231916
Encrypted:	false
SSDEEP:	96:IPGiqjELGICWPCVo61VAZ1MluVPKEb81H:IPooLGICBVo6Oc
MD5:	55B6DFD4BEE7501D0A45D4BA9A865C06
SHA1:	8D4395E23F830F37FB59FBC8A03D15753E89F65F
SHA-256:	BE03976E9EB14CD5C07E3B7B0C7AD26B637F3AFC765959D080EE91BAD095B513
SHA-512:	63B07E67AAAAAB735967651AD1B3B8FC960F2809C02AF8DADD01BBEA9A722E56AA1C0BF8E95185965B919757DB6B3E5E5EB66CB3ED555416B755142D1D6E89AC
Malicious:	false
Preview:	Remission..Black.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..Cyan.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..Magenta.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..Yellow.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..Black_SD90.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..Black_SD0.0,212.0,21.0,21.0,211.0,213

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\3CEB12CD\59B974C\TechkonDriver32Bit.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2871552
Entropy (8bit):	7.91890094076526
Encrypted:	false
SSDEEP:	49152:NnnZhJegT3345UB8r/fecnYWgPmGWy0tGGDOYEHamRS1j1fC5j9IXvWm6BPX:5nZygT33wtr/fmZxWywGGDOBxRkj1f6x
MD5:	3A0BF599146750C008BA6960C694470D
SHA1:	22E869B8C60BBFB263A7AF2B5350386617EB6E72
SHA-256:	3F1DC61B0BF0B93B1CD5478F151895B357DA92CAD2A48857E2FC4645C41E2DA3
SHA-512:	5E6ED7829C8DC1879C67FF6F142A96575251C583A5AE9103A48587BFF42C463B59B5EAB7F543414838AEA4E5BBCA6C0F8433CE3BEF6367632B663F242DF7D30F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U.....................f....................@...................................+......................................`......................+. ...............................................@...............d............................text............................... ..`.rdata..(...........................@..@.data........p...$...`..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\7C4CDFEC\F965E9F6\MSWINSCK.OCX

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8135F827\A789A22E\TDServiceLogMonitor.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9261380700304658
Encrypted:	false
SSDEEP:	384:GJzxPeOGEk4GKz7csqunx2gs1RteTOJ722RELbcAbZtLWs8:EzxNksqaJr2SLIEZ
MD5:	9CFAB4DAACA85482012D97693EA88201
SHA1:	095C31E6257CC5028E4605266477526D3B256B2B
SHA-256:	0EBB561BC5FB6FEB35ADE2BE679AB8149C9942253ADD9A1C2B7A6F53ADFE4E46
SHA-512:	9B6587CE414365420E96CA430C8DE170006CFF9ACEB51E7BF95BBFF6845AA936E8BF35D30B6442D23D48B460A085FA47673959BD3CB996970894549A71B7AB9F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..W.................P...P......^e... ........@.. ....................................@..................................e..S........?..........................\d............................................... ............... ..H............text...dE... ...P.................. ..`.rsrc....?.......@...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\8808A0B2\65F95E8\TechkonSpectroDriveUpdate.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.88327202760358
Encrypted:	false
SSDEEP:	49152:8t723QiNn1X9NVWevTX9giFzbmjEanZQTS:8k3QiNnjNVWeLNg6nmj9n
MD5:	819E58177441A1A5EAEE35216DC4B6D7
SHA1:	65306A7FEF4AC738EA7177833B1D966E0B6C0BA5
SHA-256:	2E03F7A87D69FE8B32A0B9604E270A3AF9DD3421351BE230889B7E24F2F6F88C
SHA-512:	D8B7D560364D348ABFD956ACA24EC5631AB7488E3D49C27256B829D4EA165E0C56DC579E2E0EF1209029B7559B16A401AE63CDBBB2C773DAC176D7ABBAA3823A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. ....................................@.................................h...J.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\A913E6AF\BB0F7F36\dzncore.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.22180183473209
Encrypted:	false
SSDEEP:	6144:WNO7HqL+9Qxpw1Lpaofbn+0u61wxkM2AbuACH9d7jWy:WNO7HJX16uph
MD5:	5D1E5758CEE95AC926D0C9F7C18095EE
SHA1:	8253C41EF9539BDAD5FC15DB4FABA99C23242CD2
SHA-256:	4E48950BB961EA13C4DD489D915D0DF83304D52C950A99E3E6B981EAC22112D9
SHA-512:	B074D0DE952407F5DC721DE7157EC9957A8AD98A9C04F27F04A7BA81B5F0064DEB93F8D370539A4D37598E95B9D1EC5F91B13AFEC26BBA04309138E03F763750
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^W...6...6...6..a...6..u)...6.....6..u)..S6.......6..>...6...6..6.......6...0...6.......6..Rich.6..........PE..L.../l.?...........!................9................................................................'..............`...........d...............................x.......................................................x............................text............................... ..`.rdata........... ..................@..@.data....t.......p..................@....rsrc...............................@..@.reloc.. ".......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C5D9D236\F965E9F6\lcms.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.4058590918443175
Encrypted:	false
SSDEEP:	6144:U+l+8gbiTF32Cw0oSGWhuLuGser+VbGrIQL:idbgFmJSGWhWuGseapkr
MD5:	05D89328C51E732DE076DA05239D1D79
SHA1:	C89B8500D13D540D9F6D8FA651F13E2F9990DECE
SHA-256:	EE0BC472EC26CE050315AAAE1D85AE51BAF17E8A2A548E3161DED665CF324DD1
SHA-512:	9EFE29F322A0A3049D0E5332C92A434B2F9797C0D3DB09414FCF8D6F5A01C4157716D5D252B38879312D5675712AD875B2A8D7E9407849CE1B992B94D5E50FF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9K!3}O`}O`}O`.5D`\|O`.6A``O`.5E`.O`.5\`xO`}N`3O`{.E`iO`.,I`\|O`..K`\|O`Rich}*O`........................PE..L......B...........!.....p..........w...................................................................................W.......<....`.......................p.......................................................................................text....k.......p.................. ..`.rdata...(.......0..................@..@.data...X........`..................@....rsrc........`......................@..@.reloc.......p... ... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\C64028C1\DF012C2A\TDSCON.ocx

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.853209211745096
Encrypted:	false
SSDEEP:	1536:YxeYFH0dtYcPdtYc0F9J174KlwOAYQog4wBYo4IYo4N65xpUV:YTFXNxF9j7j65xpUV
MD5:	9AA2C7DEAF5B8DBED62A60F723553858
SHA1:	6BFE53D07A3970523DC8C796EE24F392D2686BF7
SHA-256:	28D0E73EE5616C2A76829A0A430F465B598987B4798F6BA46234393E40167BA9
SHA-512:	AF2C404702563143B3ED6FC26C45D4E1CBB074F006420FF04F963C1F13783CA141C13D08918AFA9537A2DAABABC631C18DBB6562BC50AA3CB49294CCD00714F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......UBq..#...#...#...?...#..^....#..'....#.......#..Rich.#..........PE..L...Y..J...........!.........@......(........................................@......"J..........................................(.......D....................0..............................................X... .......(............................text............................... ..`.data...H...........................@....rsrc...D........ ..................@..@.reloc.......0.......0..............@..B2..H............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CC3273D\BD615B11\TechkonSpectroJetUpdate.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	7.835247620836694
Encrypted:	false
SSDEEP:	24576:foVuryMKftmxBFAsBnnJO16noCKPxKnp:gVoyMKftoYsFnI1DRPU
MD5:	6E5F4B906BD48CB77E3830F2871F726E
SHA1:	7C070D83CAD9F33D4A9EC01CDE9E0BB3AFE51409
SHA-256:	6DD53DECDE4A70E8B42657FAE088C22C07D8553E59506524ABA608BA087066F1
SHA-512:	616B153C677FE7F403D179664E24AD5FCD6041237A9A2A9FC4CA0A2C8B0050E74AA953E7349EC23780485D7D4984AA5072A8CCA26CDF9BC8439981424CC46C32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....).W..................... ........... ........@.. .......................@............@.................................X...J............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\CECD985D\BB0F7F36\dznet.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.191530389320213
Encrypted:	false
SSDEEP:	768:idEKqzhqGRvl2ZTDATBSNdCskYW50dstrF/vmifdXJNs7GGSZhRhudUrvf:idErzhqGNl2dATskYgLhfhC2vf
MD5:	2B3281E100D19123A8E307FBB2DB0939
SHA1:	501376281A00B9B9A90BE2F7DACA3DB87C96DCC0
SHA-256:	24C362E5E8819F46C23DF1D2C36C5343D088293AF4178D9ED8B966296F0BB43E
SHA-512:	3ACB639C1C0AAB53EE9FDCB3E5F9C3767F70536858D96EBEE7841567C7C1C130F5D8DFB6FF6F491B17A56B3D579C2545E8909B3C2EB5D6D5947FEA1D6C15045A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.?...........!......... ........... ........... ....................... ......"...........................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\D4D85249\AD5CD7BA\TDService.exe.config

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1316
Entropy (8bit):	4.824855858394781
Encrypted:	false
SSDEEP:	24:cPN97KgwMV+nCGgMSqX+nH1WqBN3kmugmC4mA0snxs5XFF:cPr7/wdCGgXHH1Wqfi5mA0sxsvF
MD5:	83B25C1067C9BE0BCDF289BBED80D363
SHA1:	25FABE1F042D90F5678C3F97FCA6260BF27619D5
SHA-256:	1AB2F18023EE11A92E4A3D5D7F5A9FB9A8ED8D69D93D8D804CCCEB1E431A2442
SHA-512:	FCA4C27E0FDEAD9537694168AEA7DF3F2A05FB8E05F3EA8ECC6241E8A16A801532C9F71C777AC16528747D2160B1C9B5898CB5B8AF6C751509BE296F0CF280C0
Malicious:	false
Preview:	.<configuration>...<configSections>....<section name="log4net" type="System.Configuration.IgnoreSectionHandler" />...</configSections>...<runtime>...</runtime>...<log4net>....<appender name="TraceAppender" type="log4net.Appender.TraceAppender">.....<layout type="log4net.Layout.PatternLayout">......<conversionPattern value="%date [%thread] %-5level- %message%newline" />.....</layout>....</appender>.. .. <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender">.. <file value="TDServiceLog.txt" />.. <appendToFile value="true" />.. <rollingStyle value="Size" />.. <maxSizeRollBackups value="10" />.. <maximumFileSize value="100KB" />.. <staticLogFileName value="true" />.. <threshold value="INFO"/>.. <lockingModel type="log4net.Appender.FileAppender+MinimalLock" />.. <layout type="log4net.Layout.PatternLayout">.. <conversionPattern value="%

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\EACB8D8\F965E9F6\MSWINSCK.OCX

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\EDD97940\FDA73152\defaultScan.tss

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18285
Entropy (8bit):	3.2625513904435572
Encrypted:	false
SSDEEP:	384:Lgxt0XdZ+3rWJr1N684b86fZMaTx111m+0:QiM3Q13A6aN111c
MD5:	1EBA2DF49DE0B85065585C6042C0770B
SHA1:	FE847BFA3FA1DC279BF7FDCB62BC27EFD4306B91
SHA-256:	BD0732871DBEAEE6A3BD9D5D0C5E1A32CB3752A857D203857AE2A99780004232
SHA-512:	17CA2455054057A486EA2D77439CFFCE4AFC4564E99219AAE7BB44DAE0511F552D8DC5C071A8FA01CDE208EE36EADD90600DE9976FC9CA31CE6310FDD448A005
Malicious:	false
Preview:	Remission..16.0,007.0,008.0,01.0,01.0,011.0,012.0,012.0,013.0,014.0,014.0,014.0,014.0,015.0,014.0,014.0,014.0,014.0,015.0,015.0,015.0,016.0,016.0,017.0,018.0,019.0,02.0,021.0,022.0,024.0,025.0,027..17.0,29.0,355.0,422.0,484.0,535.0,578.0,605.0,612.0,605.0,591.0,563.0,509.0,44.0,366.0,286.0,205.0,136.0,084.0,055.0,042.0,035.0,03.0,028.0,029.0,033.0,04.0,047.0,051.0,051.0,046.0,038..18.0,187.0,171.0,165.0,171.0,178.0,172.0,151.0,125.0,099.0,077.0,057.0,038.0,027.0,023.0,02.0,015.0,012.0,013.0,028.0,109.0,374.0,623.0,687.0,729.0,77.0,787.0,787.0,785.0,786.0,794.0,806..19.0,1.0,068.0,049.0,039.0,037.0,043.0,055.0,067.0,087.0,151.0,301.0,51.0,681.0,75.0,757.0,773.0,79.0,791.0,788.0,796.0,803.0,801.0,797.0,799.0,8.0,797.0,793.0,794.0,796.0,796.0,795..20.0,209.0,207.0,206.0,208.0,211.0,214.0,218.0,222.0,225.0,226.0,227.0,23.0,232.0,232.0,231.0,232.0,233.0,232.0,23.0,23.0,231.0,231.0,23.0,231.0,232.0,231.0,232.0,233.0,236.0,238.0,239..21.0,212.0,21.0,21.0,211.0,213.0,217.0,22.0,224.0,227.0,228

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\F0FC8706\FDA73152\TDService.exe

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1150976
Entropy (8bit):	7.90148039825505
Encrypted:	false
SSDEEP:	24576:+tNmK9b6A+BUpJN/SP0lm8eSqY+5bPkT0WogLEVEGlim2Vy:+36AhJ9xeSwPKBGYn
MD5:	F00223A56D3F89627CC88625DBCB0C42
SHA1:	15489E487F43F77C812EF8EF07BB65171AFEB5BD
SHA-256:	91DC55CA1A2A4B6206734C159B3C8ACC411F4B2A1BF7F208256A57B7DCBDC542
SHA-512:	12F22018BC32A98C884447FE8E44BCC1868A5133B859CB91286548A24455BCC817FC030B6BC866E282727AE48D1C88B10894FD8C3CDA809716D49BEDAA81A866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@).W.................0...P......jK... ...`....@.. ....................................@................................. K..J....`...?........................................................................... ............... ..H............text...p+... ...0.................. ..`.rsrc....?...`...@...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mMSI.dll\mMSIExec.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\ADVPACK.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	74960
Entropy (8bit):	6.080943948881524
Encrypted:	false
SSDEEP:	1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
MD5:	81E5C8596A7E4E98117F5C5143293020
SHA1:	45B7FE0989E2DF1B4DFD227F8F3B73B6B7DF9081
SHA-256:	7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
SHA-512:	05B1E9EEF13F7C140EB21F6DCB705EE3AAAFABE94857AA86252AFA4844DE231815078A72E63D43725F6074AA5FEFE765FEB93A6B9CD510EE067291526BB95EC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~c.3...."......#.................3.............p................................g....................................................%.......................... ...8............................................................................text....................... ....... ..`.data...............................@....rsrc....%.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF16.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	MS-DOS executable, NE for MS Windows 3.x (DLL or font)
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	5.626412274243338
Encrypted:	false
SSDEEP:	48:iuB0q8Z8LCQZ5U45owLkq10Ju1pwZbQP+DWmnDypKGDsQVG:NB0q7L35S22u1pwZC+ymnDmKGDsv
MD5:	7210D5407A2D2F52E851604666403024
SHA1:	242FDE2A7C6A3EFF245F06813A2E1BDCAA9F16D9
SHA-256:	337D2FB5252FC532B7BF67476B5979D158CA2AC589E49C6810E2E1AFEBE296AF
SHA-512:	1755A26FA018429AEA00EBCC786BB41B0D6C4D26D56CD3B88D886B0C0773D863094797334E72D770635ED29B98D4C8C7F0EC717A23A22ADEF705A1CCF46B3F68
Malicious:	false
Preview:	MZR.....................@...............................................!..L.!This program requires Microsoft Windows...$.......NE.<............................1.@.P.\|.....M.............R.......r.P.r.`.r.q.r...........l...0...............p...0..........W95INF16...WEP...DLLENTRYPOINT...........KERNEL.USER.SETUPX....?.z...?.....?.!...INF Installation Library...W95THK_THUNKDATA16.....................................................................EU...WQ.V..j.j.Q......j....f..]M.EU....f..]M....2...v.2...6...:.XZh..h..h>.hV..RP.....w95thk_ThunkData32..U..F..p........U...h ..h...v.f.v..@.I.=....@.........V.^.&....f.v..F..P.........t....M.v...6L...6X......Ph...........u.....P..6d........t..v.......j....F..^.&..3.^.........WV.v..v.V......N.....N.;.v.QVQP........&.?\t..F.&..\G.^.&.? t.......F&.< t..v.W.V.....^_........WV..C.......f....3.........F..F.f.v..F..P............j......P.......u......P.......t..F...j.f.v......3.....~....f.~..u..F......F...3..F.F.F.f+.f.N.f.N.h..h...N..Q......

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\W95INF32.DLL

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	2.9774207313950316
Encrypted:	false
SSDEEP:	48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
MD5:	4BE7661C89897EAA9B28DAE290C3922F
SHA1:	4C9D25195093FEA7C139167F0C5A40E13F3000F2
SHA-256:	E5E9F7C8DBD47134815E155ED1C7B261805EDA6FDDEA6FA4EA78E0E4FB4F7FB5
SHA-512:	2035B0D35A5B72F5EA5D5D0D959E8C36FC7AC37DEF40FA8653C45A49434CBE5E1C73AAF144CBFBEFC5F832E362B63D00FC3157CA8A1627C3C1494C13A308FC7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=2...........!......................... .....p.........................p...................................... .......@..<....P.......................`..0...................................................d@..(............................text............................... ..`.rdata....... ......................@..@.data........0......................@....idata..@....@......................@....rsrc........P......................@....reloc..\....`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\asycfilt.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	147728
Entropy (8bit):	5.909287934496192
Encrypted:	false
SSDEEP:	3072:h+qD1Cd/Oa5kXFlqkFGr3CAP7LCyInPEggen5Ez:hlCd/OaaFEjCAPKyOE6na
MD5:	C89E401800DE62E5702E085D898EED20
SHA1:	72FB4F088C6AC02097B55FB267C76FBF5E0FA1F7
SHA-256:	DE83C9D9203050B40C098E4143EF8F577AA90016C7A64D4F2931B57A4C43E566
SHA-512:	70006D70DCB47361FF43E4F7C458655AD2474B70CB917873AA77D2CC06465A68D375D36C494D154A03DBBFF891DF7DD6CAB3D2C7B08E8650B9FF170E30838070
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ru..ru..ru..mf..ru..ru..su.Rich.ru.........................PE..L....!.6...........#..................... ........<e.........................`... ..^q..................................n.......d....0.......................@..0...P!............................................... ..L............................text...n.... ....... .............. ..`.data....d.......P..................@....rsrc........0......................@..@.reloc..v....@... ... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\comcat.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22288
Entropy (8bit):	4.814478820147639
Encrypted:	false
SSDEEP:	384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
MD5:	3B180DA2B50B954A55FE37AFBA58D428
SHA1:	C2A409311853AD4608418E790621F04155E55000
SHA-256:	96D04CDFAF4F4D7B8722B139A15074975D4C244302F78034B7BE65DF1A92FD03
SHA-512:	CF94AD749D91169078B8829288A2FC8DE86EC2FE83D89DC27D54D03C73C0DECA66B5D83ABBEAA1FF09D0ACAC4C4352BE6502945B5187ECDE952CBB08037D07E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rD.2....i......#.....2...................P.....w.................................................................?......*<..d....`.......................p..4...............................................X....................................text...#0.......2.......... V...... ..`.data........P.......B..............@....rsrc........`.......N..............@..@.reloc.......p.......R..............@..BkD.2(.....22...jD.2?....%.2J...........ole32.dll.KERNEL32.dll.USER32.dll.ADVAPI32.dll..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\mVBExec.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1326592
Entropy (8bit):	6.662178971692568
Encrypted:	false
SSDEEP:	24576:9JGBDZIKwoTaK/T/Tua+hWWfnElT/XhBiSwmK9lHcPJMgh:vqxaSzqUNBXhkSwQPi
MD5:	AC12DEC48405495C2008858D243DA8BC
SHA1:	0B6AD42CDE232A81B415481B772319FB1138C35E
SHA-256:	AD45020E327C16F0A847C38A058E606A7738EA6D0DDAAF80439797CA95F5FD43
SHA-512:	F6A381063DC321C85BD9FFECD524FCFA4EB968AA7644AB339F292B7037BE9C1FA997D2CAD382BE92848010AEEEA38209908B5FAE17CD0B261E0DBEFA38BF5F58
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.....................t.....................Q....................................................................N.......\7.......Z..........................................................................,................................text...\........................... ..`.itext.............................. ..`.data....M.......N..................@....bss.....T...@...........................idata..\7.......8..................@....didata..............P..............@....edata..N............Z..............@..@.rdata...............\..............@..@.reloc...............^..............@..B.rsrc....Z.......Z..................@..@.....................>..............@..@........................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\msvbvm60.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1386496
Entropy (8bit):	6.507253562372704
Encrypted:	false
SSDEEP:	24576:jrWIEO0eDfcPOvCOpMEPJonhql5oHS+zh3JajtObuF+T+NUFRjUgIeX40sgdp:jrOuCQhJohq3oHrh3JajtObu2+NUF5Vd
MD5:	F28EB5CBC3CA6D8C787F09F047D1F9C8
SHA1:	70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5
SHA-256:	3EF32E0152CC3FA07C417E6AADF9EAD83A17B5FDEE73799044E1BD7564725D6E
SHA-512:	84F811F75E9D5143898728D2109B349802A292D4EF2CCAE4B4421D20268A33C6DDEE9C70E8BDEB474A3AC70307B2554C00CE786CA1F446807610FA2717F3745F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:@...........#.........v.....................f......................... .......N...............................0...Q..............L.................... .......................................................................................text.............................. ..`ENGINE.............................. ..`.data....n.......p..................@....rsrc...l...........................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\oleaut32.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	598288
Entropy (8bit):	6.644743270512807
Encrypted:	false
SSDEEP:	12288:HCKynQWKglDhrUtrvT/NInIk4NDXsR6lMlpGz:HGXqB8V6lMlMz
MD5:	7B156D230278B8C914EF3F4169FEC1CC
SHA1:	6B58E20B2538CB308091DA838710F6AAD933A301
SHA-256:	BAEB2F7C1B8BE56738D34E1D1DDF8E0EEBD3A633215DC1575E14656BE38B939D
SHA-512:	E4EC2BC714069E0A6B56D89B52AABAD92E5BA741DC6F26D2FC2D72AA9AD2EC465DEA523CCCD810331AB78B5FB8A1244B2B521303418EAD5BD6BE5A58B43794C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ibW.-.9.-.9.-.9...7.(.9.{.*.,.9.-.9...9.Rich-.9.................PE..L....#.6...........#..... ...................p....4e......................... ......+................................6..%$.......................................g...................................................................................text............ ... .............. ..`.data....a...0...`...@..............@....rsrc...............................@..@.reloc...g.......p..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\olepro32.dll

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164112
Entropy (8bit):	5.8462943829831575
Encrypted:	false
SSDEEP:	3072:+VrhrwLXcA2Ha/joWklbo/Acjwm4AaW7zozn/zgOh0Z76:fklbsqmyWnoz/P
MD5:	CE0155405EA902797E88B92A78443AEB
SHA1:	8ADFF69050D14A57D7F553CA8978439AF188C192
SHA-256:	789C3C45EDA1749BD939F4A96616E1E9EF1B7DCC62A2889F65088954C64D0938
SHA-512:	3FDE09067F9CA8D315DE07C8DB972F99723EA4C3F997DC58210F9D6565CAA9935C79F13E8B2D20ADC5609919A381E4C2A90A0B3123A35947997229D7C615E162
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.'r!.I!!.I!!.I!w.Z!*.I!!.I!\.I!Rich!.I!........PE..L....!.6...........#.................)... ........0_............................. ..>................................................0...3...................p...... #............................................... ...............................text...q.... ....... .............. ..`.data....X.......P..................@....rsrc....3...0...@... ..............@..@.reloc.......p... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\stdole2.tlb

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	4.083884450202126
Encrypted:	false
SSDEEP:	384:cogoEvM/uFrR+X6QNn1pcJIrWocDGWct:cogoEvM0rgqQNn3
MD5:	1B02577F0ADDEA32EB02A50D4A4CDD1E
SHA1:	36F701CCEC78A5D218FEA23FD05351890F14CF7D
SHA-256:	6EA525BFACE5467C1045C3708F339A4B92A3A273F70656E061C7F7322C56D667
SHA-512:	87FD4AA5158D09EB97B6131E651DB2A4761546907A960AF7792F8E95947C0A825E84F88ECCF42EC896FF5BB2BBC461488B898D5F1BD853847317493C44B330C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eU!.!4O.!4O.!4O.!4O. 4O.Rich!4O.................PE..L....!.6...........!.........D...............................................p...........................................................@...................`.......................................................................................rsrc....@.......B..................@..@.reloc.......`.......D..............@..B.............!.6............ .......8........!.6............P........!.6............h........!.6.....................!.6....................@:...........J................T.Y.P.E.L.I.B.MSFT................A...........*................................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...............h...........................................L...P.......

C:\ProgramData\miaE9AF.tmp\data\OFFLINE\mVB.dll\vbrun60.inf

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Generic INItialization configuration [DestinationDirs]
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	5.4959184158351215
Encrypted:	false
SSDEEP:	24:yuZq732XeLfX8IUy3k8exg5S3X8n2uNXVANXVMbNX9NXR/NXVuZZNXV0pT7:BJeL/8IhvFSn82CVoVMB/DViDV057
MD5:	F8854BDCD55ECCF24F077981ADFE6B9A
SHA1:	377FC226B1C10B244F1E32F6EA3A20B5D47D4777
SHA-256:	E5A9050E93487A1D296CEEC10B95BE9F92EB877AA2913296B5C31B9F74F7C788
SHA-512:	6331F337A1595D6F83281614E6A92AABA9D8B27FDA3B5CF4E85F1B49AC335E10F0F62CD147131D53C473B3ACC42BC27F2D02073F0CC60755CA10871EF2E7AC8E
Malicious:	false
Preview:	; INF file for Visual Basic 6.0 Run-time Redist Pack....[DefaultInstall]..CopyFiles=install.files..RegisterOCXs=RegisterFiles....[DestinationDirs]..install.files=11....[install.files]..OLEAUT32.DLL,,OLEAUT32.DLL,32;..OLEPRO32.DLL,,OLEPRO32.DLL,32;..ASYCFILT.DLL,,ASYCFILT.DLL,32;..STDOLE2.TLB,,STDOLE2.TLB,32;..MSVBVM60.DLL,,MSVBVM60.DLL,32;..COMCAT.DLL,,COMCAT.DLL,32;....[RegisterFiles]..%11%\OLEAUT32.DLL..%11%\OLEPRO32.DLL..%11%\MSVBVM60.DLL..%11%\COMCAT.DLL....[OLEAUT32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=2,40,4275,1....[OLEPRO32.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=5,0,4275,1....[ASYCFILT.DLL]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[STDOLE2.TLB]..file-win32-x86=thiscab..RegisterServer=No..FileVersion=2,40,4275,1....[MSVBVM60.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=6,0,97,82....[COMCAT.DLL]..file-win32-x86=thiscab..RegisterServer=Yes..FileVersion=4,71,1460,1....[version]..signature

C:\ProgramData\miaE9AF.tmp\data\TDService.msi

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\miaE9AF.tmp\mia.lib

Download File

Process:	C:\Users\user\Desktop\8ue90oYkrv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.dat

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.21221799398743
Encrypted:	false
SSDEEP:	6:SpXr+pVSDDDLm+6WWq5vR7xXrlqt+TzTEQjM41wy:SpOSDC+Zb7eKTEsMXy
MD5:	5E1B362822AF7B65CEADD04E17FE93DD
SHA1:	E97136FF549A5EA648B53C852A6CF83D7B214CB8
SHA-256:	3BA47D29D3B8810C479BD6D3D470FC400AA15AA35187BB1FA72C7E20E2573009
SHA-512:	76A2D74395DA1EB6E2292B9CEB743718C9AA8BC03E0F88F7A250E281B5DBD4394429979B89BBD878822984B8C7B821667F2BC30BD833B0CBCA1B61DA23CD0F19
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..TECHKON Device Service..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..11974355..TECHKON DEVICE SERVICE..1150976..$..C:\Program Files (x86)\\TECHKON GmbH\TECHKON Device Service SDK..TRUE....C:\PROGRA~3\{C39D0~1\..MYAH64WOW..x64..OVERRIDECACHE....NATIVE_ENGINE..FALSE..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5295078
Entropy (8bit):	6.41595061147608
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJF:hTaRZ8tjD4+wD5ZksyPHIFIF
MD5:	A94A3D60FA8A54AB71ABED39D5883D86
SHA1:	3FC14B383FD699017AA7B7281C28F143AEAF7B9F
SHA-256:	3AC4616A5ABF9A408EDCCC48D15AB9DD6441DAD273C8F477C1EB291812949451
SHA-512:	172CE336A3343D8ED92EDA525A549F1E388D37076F71DC28C043FABC94B04761B7E936871F203C2B681EB4BFCC8C239327656F51003CD46D11C94589B1E8CC13
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.lnk

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.msi

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Words: 0, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	766976
Entropy (8bit):	6.307836502585046
Encrypted:	false
SSDEEP:	12288:HUbU4DBKXsbzeDSJoQ8guBoN2KA2wKc7wMz7:HcU4VE5BqPA2fc7wMz7
MD5:	D471255784CC4AE28EA97447F67DA9F2
SHA1:	AC46FC4DD17A2F6BACFD33015B695970AADBA875
SHA-256:	A35926623E6DAEF708BD51436D547BEE6B15DCC6DDAE52A74FDC323F1F8ECD26
SHA-512:	760C4ACDC725549002D59B432FC4A55D065E72D6909D7EF2D8468723A2BF419581F258A373161974133087546B97216044B6D222930077960323528211A90A59
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.par

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	5.357798355644986
Encrypted:	false
SSDEEP:	48:n52QnlauJANzvc+/zM2WTZowX6U4WqARxCmlyqGkcz8wV30/33Bs+:PZhJwVUBH
MD5:	E7433271C48AC5C443718ECC8CC5C8D6
SHA1:	963F524D432FCCEA6D1A0F263C3FA71BF12D41C4
SHA-256:	41490736C33D4CD6F25F7958C8274B6FDE22B6AE52C4F6AAA5884B45D8E52BA0
SHA-512:	B925D0FA81ED211D7EF5247A770A7F4DAAD2A1AF1505484AC3946D3C6B1342688643A6E138E5E8D891E2785518DB33E5DFB1B16FEC6A02C7B9C7A967C9CAF2BC
Malicious:	false
Preview:	.AEDD97940..FALSE..A3CE6DECE..FALSE..A34E6DE3C..FALSE..A25D64044..FALSE..A3476C065..FALSE..A8135F827..FALSE..A8808A0B2..FALSE..ACC3273D..FALSE..AA913E6AF..FALSE..ACECD985D..FALSE..AC5D9D236..FALSE..A1A2661C4..FALSE..AC64028C1..FALSE..A3CEB12CD..FALSE..A1872974D..FALSE..AD4D85249..FALSE..AEACB8D8..FALSE..A7C4CDFEC..FALSE..A95FFAA1..FALSE..AF0FC8706..FALSE..AD7FB24C5..FALSE..A86D611ED..FALSE..AEDD97940..TRUE..PEDD97940_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A3CE6DECE..TRUE..P3CE6DECE_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A34E6DE3C..TRUE..P34E6DE3C_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A25D64044..TRUE..P25D64044_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A3476C065..TRUE..P3476C065_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A8135F827..TRUE..P8135F827_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..A8808A0B2..TRUE..P8808A0B2_1..C:\Program

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\TDService.res

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3831837
Entropy (8bit):	6.288047394335939
Encrypted:	false
SSDEEP:	49152:zXlXDzXmLXrXxXzX4XOXWXmOX+rXAEJD2d8hMcSCnmNPIkFVZ+cocaFjhkSYKPM:xw4BF3ai
MD5:	3EA26D5D84024858345551BDD209F62A
SHA1:	DE89AEAB1CBE1328B0CDB7C17BE2B43BEA076E30
SHA-256:	E58F0C20DFFBB1299D972CC7C3556DDDDE8D6888570FEEF208E48EAD68877149
SHA-512:	5E8F2CCA528F77CC624FD17228D796E3921008A9D73511793E33FE6F4B94463D5304A969A4F18DD0BCDD2C5B0663861570E861DAC58355EF641860BB071AE607
Malicious:	false
Preview:	7z..'.......'p:...............M...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\instance.dat

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.763214906845461
Encrypted:	false
SSDEEP:	3:fCSpmrc5Pk+T0kcAwS+h2h2MxB:rsc5Pk+r0grH
MD5:	36487EC6BBA7512EFC29BEFC31D9C8E0
SHA1:	BBC7D906BFEC90E60D3ED2768FD3DBF1E23A831C
SHA-256:	96DA35BCA6739A48B794F7A93643A4B449F1BDBD0A4506B2CEE752ACF351DF15
SHA-512:	044444B2237DEE8C9CBFB966F9C3EEEBB6FBD0D86643E692E0686A0254919218DB4277A50EF251A26D112286CF64A21685191052B1C31CE03186EF25CB30AC0B
Malicious:	false
Preview:	{CD1E6019-47AE-4334-A91E-595BA68B6E06}..{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}..TECHKON Device Service..

C:\ProgramData\{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}\mia.lib

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.dat

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.172580566169641
Encrypted:	false
SSDEEP:	6:SpU7SDwVs6ZU9xXiaQoOXtCBnTzTEQjM41wy:SpU7SDXo6UoOd8fTEsMXy
MD5:	78A3F93BD0082F553E5B911C0DF9A218
SHA1:	C435D901BF62921AE6FA320616909CC7EA59A0E4
SHA-256:	B40D65735A6D1D806908ED541F1701C7AD59A9264E0C1081FAAF40635F9024FB
SHA-512:	9C48437D2270962228A0DE928E36E3D4829A932153AC7CF74E2A98895F97FB1E3C884FBF3D49EEE4DDADDEEC3004283E34152527F65B5EA814D3C943D41D395E
Malicious:	false
Preview:	MYAH-PREDEF-COMPONENT..TechkonDriver64Bit..$..TRUE..TRUE..$..$..$..$..MYAH-PREDEF-COMPONENT..531006..TECHKONDRIVER64BIT..0..$..C:\Program Files\\TECHKON GmbH\TECHKON Driver 64Bit..TRUE....C:\PROGRA~3\{CDCC2~1\..MYAH64WOW..x64..OVERRIDECACHE....NATIVE_ENGINE..FALSE..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5299123
Entropy (8bit):	6.417889890443472
Encrypted:	false
SSDEEP:	98304:hSmaRfSnG5itjD4+j05p5Zxa8byNFzH2bP4PqyK13icjqsNTUjJk:hTaRZ8tjD4+wD5ZksyPHIFIk
MD5:	5A3DA2206BD35C381B826FF748093684
SHA1:	AE5A7D9CEB4324BCE26B6E2ED7C1FE18DEAF917E
SHA-256:	E94B30CF6F7FA8F30EB21B5A4B3316B5F005321C31A2139095882450D8BF8C78
SHA-512:	DBA818B5E442EA797E4F20F313C2196BA366DE82784968A1F2F29C8F3AAEE5BC09B7B9CC33A959C0E2507F31517E32D48C118CDE5119A741C5378DCF29856801
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.exe, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......V..................8..N.......d8.......8...@...........................U..................@...........................0;..T....?.......................................................;......................?;.......;......................text...,.7.......7................. ..`.itext........8.......7............. ..`.data.........8.......8.............@....bss....t.....9.......9..................idata...T...0;..V....9.............@....didata.......;.......9.............@....tls....P.....;.......9..................rdata........;.......9.............@..@.reloc..@#....;.......9.............@..B.rsrc.........?.......9.............@..@..............U.......S.............@..@........................................................

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.lnk

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	Unicode text, UTF-8 text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:g:g
MD5:	ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA1:	57218C316B6921E2CD61027A2387EDC31A2D9471
SHA-256:	F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
SHA-512:	37C783B80B1D458B89E712C2DFE2777050EFF0AEFC9F6D8BEEDEE77807D9AEB2E27D14815CF4F0229B1D36C186BB5F2B5EF55E632B108CC41E9FB964C39B42A5
Malicious:	false
Preview:	.

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.msi

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Code page: 1252, Template: Intel;1033, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Words: 0, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.313135922265424
Encrypted:	false
SSDEEP:	12288:DRU4nBKXsbzqDSJDQ8guBoN2KA2wKc7wMz7:DRU4BF5BqPA2fc7wMz7
MD5:	6957CC6E903D183839C08109EDE46105
SHA1:	9B97658AE2F1452D4A61C69BC2E303A7D36DC4D4
SHA-256:	51BDA45008F6A3D616E94FDA63849A6E766B5509E1E5259EA8359A2466A5F2BA
SHA-512:	2CD1018AA29FD898CCACE29582AE84A6291E991C74848939EB05F3B6B11BEC54ED16DAB8C95F648205C8FEF583DFB25E93D8CA6D4AB3A618A84ADB7E27D3FB16
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.par

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	5.369966676914094
Encrypted:	false
SSDEEP:	96:7lpWBZ9pJNvlVPgXPaPsqJziqWq2FmGihH1c8ABhBdFFP5iqcXTUrXzgO:7lpWBZ9pJNvlVUSkyiPzwGihH1c8ABhX
MD5:	238D1E9B674FCD0B8A77A928DFF29C22
SHA1:	50E3E75DD2B48E8E1B8270B609BEFA2F233DBD3F
SHA-256:	BFFEF270E9609F75876B38AA6E7F7AF8DB2BD4935791477ADD6C034EE990AEF2
SHA-512:	96CC49664A0A4C3D9417EDB3DC9B3B469B11D4E434D2D837028AFCECD996E6ADA3C02E72B74807691256FEDBD0BC509827EBB25CA0B69B7EDCD9F2324A98AC35
Malicious:	false
Preview:	.A76FCA102..FALSE..A150AC403..FALSE..A1ABF3862..FALSE..A502E833A..FALSE..ACE56FB43..FALSE..A52B152B3..FALSE..AC0AC9330..FALSE..AE09F5A5F..FALSE..AF2F92670..FALSE..A94312164..FALSE..A5809A5D8..FALSE..A56A7DD7A..FALSE..A1A9DA512..FALSE..A84FEA59D..FALSE..A849003A2..FALSE..A98500B5D..FALSE..A4F27760E..FALSE..A4D56F533..FALSE..A7AA455DC..FALSE..AE1318D92..FALSE..A66980B9F..FALSE..A9167C40A..FALSE..A15F69ECD..FALSE..AB06B5044..FALSE..A66E41FEB..FALSE..A9E7D6EA9..FALSE..AB258770..FALSE..AB5CD4D0..FALSE..A537BC2C1..FALSE..A5D1665DA..FALSE..A6EB99A04..FALSE..AF5C9AD93..FALSE..A21D6E643..FALSE..A63D6488F..FALSE..AF835DFEA..FALSE..A9115C352..FALSE..A76FCA102..TRUE..P76FCA102_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A150AC403..TRUE..P150AC403_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A1ABF3862..TRUE..P1ABF3862_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..A502E833A..TRUE..P502E833A_1..C:\Program Files\TECHKON GmbH\TECHKON D

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\TechkonDriver64Bit.res

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	3821599
Entropy (8bit):	6.2872927335703555
Encrypted:	false
SSDEEP:	49152:YXlXDzXmLXrXxXzX4XOXWXmOX+rX14rFRMSigFEkEi24EJD2d8hMcSCnmNPIkFVT:cTE94w4BF5
MD5:	839619AB3C498F9119516797217ECE8B
SHA1:	83593C1247452E23F900E2F383B80FCE222E77D5
SHA-256:	C0BA92E82179F99A6CBAE6B26E2CF94DA86D9C2A89FC71552484150D4FB1A237
SHA-512:	8947009EE28BD4A8D6C2BEE4B03474A981A28C789021B31C6B3010FD0727180F16D7FE95F35DE13A533CA56953DE37CC088F496FA82CD4FA0371B9D422C79816
Malicious:	false
Preview:	7z..'...P=".'H:..............oB....TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\instance.dat

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.682207123816963
Encrypted:	false
SSDEEP:	3:P1UckThRSnhZTYIT9ovtndNpnCmiTQeVnh2MjzXFTBQov:9UckTynVT9ovtndfCmi8eVhr3fQov
MD5:	6F37D4EFB813C85449B22D66C053DE6B
SHA1:	DDE70506FB522175DF612A6ADDF04E0009B30FAD
SHA-256:	3687950173500CEF8D7F3EB691FEE0F08866C463E4434282C8DD2A36EDC4A7C2
SHA-512:	5205A6BD0496FFBD307E9D49254D23E71D8C04C04F16A4E57AF708B826306AEFFFA999113D5A1FAFCAEA444C56D33ADAFF994337E6FE0D487C42EDBC289615B9
Malicious:	false
Preview:	{55EA8940-B618-47BD-A642-20BFB2A64F78}..{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}..TECHKON Device Driver 64Bit..

C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\mia.lib

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641845
Entropy (8bit):	6.759953089731109
Encrypted:	false
SSDEEP:	12288:nmkzB+dtRRReCYRo38KLg/lIH4L4Y4pgSss:LoRRYu8KU/6YLg
MD5:	AA00215FC4A6D307A143871D1C9904A6
SHA1:	B8A3C08DE2FB1356965FE5EC5B53102303F84DB5
SHA-256:	F2E0625F96D32063FADDDA808AF9A435D430707717529FD1EA6C96DEA1DE13CA
SHA-512:	547C273300F87378F61E7FD93CE683D2DDF3B9886E735B66591FBEEA7B5953D6A8112C442F277A4E3CFE4A24995E437AA03CFB2F375CE8A035E168236B05775C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).n.m...m...m...d.......d...@...J.m.l...J.{.d...m.......d...y...d...%...d...l...s...l...d...l...Richm...........................PE..L....QkT...........!.................e.......0...............................0............@.........................`...........d....0...............................................................................0...............................text............................... ..`.rdata......0......................@..@.data....^......."..................@....rsrc........0......................@..@.reloc...C.......D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IIIQF\7z.dll

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	6.279217790646268
Encrypted:	false
SSDEEP:	3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
MD5:	31CAD6A3EDD1C32981AD6B565CBEAC94
SHA1:	9338978C85A9423EE2A38CBA027F79192D684F1B
SHA-256:	B8521ABDA09EC17DDAD36528C1BC50395DC8C5F7C11C026A5B3FF23110C54182
SHA-512:	02E198B8EF192DE55DB35AE00A16A80B3309A9373A596C20D617B43DD7159A635BC303F371859E704375521A1242D02754807E2E9DFEF63FFD06993B24C17D3D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..P....................6...>..............._...........6...P...o.^.....o.j....................Rich............................PE..L....S.L...........!........................................................@.......................................@.......9..P...............................@.......................................................,............................text............................... ..`.rdata...@.......B..................@..@.data.......P...4...4..............@....sxdata..............h..............@....rsrc................j..............@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lang.loc

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	197429
Entropy (8bit):	5.976046888177846
Encrypted:	false
SSDEEP:	3072:VZ2NCsffL4WCb+gS5MJBdpzMObFz7m/RktZtUEEgny32rf:/4L4YCBdpzMAFe/oZtUYny3i
MD5:	B87AFAA4E8FE37C2878E240D7E5B74C4
SHA1:	BD4996CD4CC682E9DC8966BE8D697C91F46FABD7
SHA-256:	077898C146E917107BDB281F4E21C380C5E6B18E9B2213FBDE8FE5FD086336AE
SHA-512:	1EDC62AB821DDDA0EA312CFE4D79F908E3AD6B28C87C903CD956EC9A12E6F62010380A1C0801601185A30D24F9897D81A37A14BD4891E303691DCED2A50F7D1B
Malicious:	false
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

C:\Users\user\AppData\Local\Temp\mia.tmp

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	71603
Entropy (8bit):	5.523940105836007
Encrypted:	false
SSDEEP:	1536:ewNhtmrNAKe1J4eFiLIidSxfuisTJIHvxDZN7kAblAFKqZLYjz1:Vtm572J4egLI4wIZYjZ
MD5:	6614F2128AFB570A9EB3BFBAC47340AB
SHA1:	99356886CF9A2EB83492EED2D1C7F7190353BDDB
SHA-256:	645F8C9588263BB3B0A5BA31A1705EF8931B2247EF6113C2F18F375B67DE94F8
SHA-512:	680B81C9BC89392B4068466AF9CA1C7053DFF548FF34BEEDDDC97A80C324DA696DC955EE6412073FDDE4442031C82DDEE6DAE2A0AAD140877D44941024C446FC
Malicious:	false
Preview:	.Comment..Comment..Code Folding Region..Get System Settings..If..MessageBox..Terminate Install..End..Set 64 Bit Mode..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Set Variable..Set Variable..Comment..If..Set Variable..Set Variable..End..Comment..Code Folding Region..Comment..Code Folding Region..Comment..If..Comment..If..Terminate Install..End..Comment..Comment..If..Set Variable..Set Variable..(Un)Install MSI Setup..If..MessageBox..Terminate Install..End..If..MessageBox..If..Reboot and Resume..Else..Terminate Install..End..End..Set Variable..End..Comment..Hide Dialog..End..Code Folding Region..Comment..Code Folding Region..Comment..Code Folding Region..Comment..Define Component..Comment..Comment..Get System Settings..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..If..Set Variable..End..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..Get Folder Location..Code Folding R

C:\Users\user\AppData\Local\Temp\mia1\TDService.msi

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309158560991388
Encrypted:	false
SSDEEP:	12288:tZTHM43BKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:tFM4Rx5BqPA2fc7wMz7
MD5:	BB476839A65AB03B7419B1285080C884
SHA1:	9321332A351363696DF3F12FB8FDC602043CAA95
SHA-256:	FF54C9A79D8DBB85E232B5E9A5C3C8F5AE32558B65CDE7935084A4E705BB21D4
SHA-512:	9BF03E54FCBAF7FF7031155C16B59BF5AF039D3145AFEBAE7036A93552CA3621A40FDE80207F787D599C74AD366D5A116F50DE5374700658C8DFE85E6E8C3792
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32879
Entropy (8bit):	3.303772475257304
Encrypted:	false
SSDEEP:	768:VDHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfwE:VDXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DA
MD5:	7ABD6BD2B201E76EA624B72EC854E178
SHA1:	B74ECA13809A2439B0A8B769328247EED6ECA6CC
SHA-256:	B7E2337DDFE813C051D10B5CBBBBDC7FCD0EEF4B5B2621C3A77D6B91743C0F4D
SHA-512:	66AF2C8901D8B421C1BC1265CBC8495E19C2346BF8B97D280079E1200578D450B6DEA570B712D350D5BE0A8B88A2615BE4075008D85CCA3CCF5D28A4D9194A9E
Malicious:	false
Preview:	...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32756
Entropy (8bit):	3.2836876237576345
Encrypted:	false
SSDEEP:	768:XyHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfn:X6XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DU
MD5:	BF3263127CD771470559490ADB76647B
SHA1:	8971CB4959D1BCA4A0EC48F3186309B00E16261B
SHA-256:	4811574E264AEB0927806A9A953CEA2A903ED18C36A34A10B67E40B99CA1670F
SHA-512:	9AF82B1F3EB3E735E2434BA803C1FC6D13BC1866A73D9F0FF466A23A5761291DD00A6C0D57BD24CE6CC2DCD0ACC16E863A2F30A41FC4BBBD041578F85AF6AD27
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	161047
Entropy (8bit):	1.9896602276153565
Encrypted:	false
SSDEEP:	192:E3Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CWNux1uAw1Dmi:EtI/gWf
MD5:	5F7AE8AAAC7F8E1E811BE95B187ABB10
SHA1:	C34C69B5AE6B4B2EFAE3236C386F2B0388F815A8
SHA-256:	984A34337FC921BCCBA721B8361D3806459D2F37CBF117F5CC35D6BD0D6FEF6D
SHA-512:	0A6F8E499686102AD85DD411958B3417A4E758FAC61A1D883420490AABDEF0F6CECED358997F83AB84FF7DC2D01A3E90903C899ED382B97165CF019B8C213709
Malicious:	false
Preview:	...TFRMDESIGN.0..u..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	5.018115004625162
Encrypted:	false
SSDEEP:	24:UuikSi+nfi0ZiFuEai/pZSruicvSi+pipUivuNsIi/pEaiDatfi/pTvSgREii/pH:U5ExAGVPbu1ZRMfkf3faWYt
MD5:	2FE4E500443ECB1E27A767BEE9A18C63
SHA1:	887A5789CDAC46BEA2829870DF02AD6B87A92270
SHA-256:	6492FEB41031C64C70FA8FABAABCCDE4846F9438B017D152C68C4B356C6A167A
SHA-512:	9475EB0E7509493A23DEA491CFA0A9A1DB0D339C216F1E38512DF18A74D80C69B6C8CE9C10131047227FFA3E979D5D6F144748569CFD9209C47977D770D94DD4
Malicious:	false
Preview:	IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkSuccess.Caption = COMPLETE) THEN RunNow.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkSuccess.Caption <> COMPLETE) THEN RunNow.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := Fal

C:\Users\user\AppData\Local\Temp\mia1\installaware.png

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	7.871063017224323
Encrypted:	false
SSDEEP:	24:X93kpZjQLmEcxtIwWXPAGpKpkZcks41xdrqUaBdJbYfxpJgx7YWg/uLwdCnq:N3Yj8mEcxywiPrpKpNMdr07SxgSt
MD5:	B7225A16DAF9DE1D514AEFE567FDF2F5
SHA1:	D6A00C526C425FCD5EF49B0C87814F2CF476CB59
SHA-256:	0E2DEFC9B470D3F9BD184D254493EFAD94EA0273C1FE17FC8FC651D47B01734E
SHA-512:	31412603AE87F2B9C9DAD2D0BA64868105586D1778846DE5F1C14667C4292DE36FC193B54670BDF130019B0B42AB59EEF2C2D8672226BA755181FEA894BD9246
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.W.L.W...!..dl.'.@.10.a.....2.T'.....SD..-PK@t.....:53.... :#F.......\|"...L....6 m)Lw........9...K.+.b...z.x........=...J.V....n3[.B..v[m..../....o0.L....Q...&...$~?%%?PG..S<..]...$.Z......O.3".k....m]..2S9..4,.k+.xf..k.F...V..4[Ec'K.2.2..PK.....H$..H.....kA...M..>.zs.....^...K"...j..:..Hu.T..Q.....N...y'.+9.dR.{..Xn....w.f...R.KQB.]z........6>..,.......q.%........;.,......U{.i....Z.....)._I..7..J.q..d)...CM....;...,R~.B.S...E...p[-O........].F...%..A.%....{.%....]Q..>.-..f..C..i.Q..+5.......A'~.....J...M.mtN..0..r.>.@K.....D...<...CI^#.-.P.}?R..M.-.7..GS...Z^9s..<6.....>......<..g.~.9....{]Ju..}`..Z(..ikw^.,)X..g...\|G.LQ9A^...9pe....7d.......SE.Q..../nx.}_..F...$..I..K...o4.^ ..e.X.Q.H......&........Q..............\n....J......./...7.....E.9.....$...K..!...c.`.=.Jd.nq.n.W.Q...Q.#s.w._.d....u...Q].-U.N.J..&.O..=......a+.k.....%.$..(.....@`...lx.......tDC..=.{...^"...@.....\{;#.^...G.q./AA.

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32086
Entropy (8bit):	3.1568876532608567
Encrypted:	false
SSDEEP:	768:PGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfp:P+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DC
MD5:	D5DF18B96E3A0E9DA52766BDEB603E4B
SHA1:	A1D313F08A9B663F8DB7BCB258EFA616BB2618DB
SHA-256:	C1E2B73702BE7EA8E2BB9CEC1F9D210757D67EB950D8A22EA39E0E2C5F9AF6B0
SHA-512:	AB60CE2806739B62EC063FABA81A17CFEEA3CFCD546E9DD8F486DA3491DF3BB76C7020E35B5C2898A923736672E3AE9CA2400978DCBFBD8B75E76B579B85FED1
Malicious:	false
Preview:	...TFRMDESIGN.0.B}..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\mVBExec.dll

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1326592
Entropy (8bit):	6.662178971692568
Encrypted:	false
SSDEEP:	24576:9JGBDZIKwoTaK/T/Tua+hWWfnElT/XhBiSwmK9lHcPJMgh:vqxaSzqUNBXhkSwQPi
MD5:	AC12DEC48405495C2008858D243DA8BC
SHA1:	0B6AD42CDE232A81B415481B772319FB1138C35E
SHA-256:	AD45020E327C16F0A847C38A058E606A7738EA6D0DDAAF80439797CA95F5FD43
SHA-512:	F6A381063DC321C85BD9FFECD524FCFA4EB968AA7644AB339F292B7037BE9C1FA997D2CAD382BE92848010AEEEA38209908B5FAE17CD0B261E0DBEFA38BF5F58
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.....................t.....................Q....................................................................N.......\7.......Z..........................................................................,................................text...\........................... ..`.itext.............................. ..`.data....M.......N..................@....bss.....T...@...........................idata..\7.......8..................@....didata..............P..............@....edata..N............Z..............@..@.rdata...............\..............@..@.reloc...............^..............@..B.rsrc....Z.......Z..................@..@.....................>..............@..@........................................................

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160192
Entropy (8bit):	1.9416958546631025
Encrypted:	false
SSDEEP:	192:TdRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cdtq69wTEmC+:TvI/Lw76
MD5:	68E84CD5CA646B0204CD019CC6B63DCD
SHA1:	B00E7D577E350F96149E5C14C6DDA8B05994462D
SHA-256:	ECCE7B76CEE8E1C10D828DC932F1BFDC782F1B599C1BF13651C21B73A5AE1A4A
SHA-512:	E848350BD35C9DD7B7AFA741BD4089763EA990B7F27AF96C3067E308A9AF812D83DB5F48E2EF8A6CE3E221036B1C76F0802A87DF9FC16CEB8C3B8E03619A1C85
Malicious:	false
Preview:	...TFRMDESIGN.0..q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32211
Entropy (8bit):	3.1826203678135156
Encrypted:	false
SSDEEP:	768:iVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfb:idXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
MD5:	1074D7C4D94AF399F1F6137AD183E70D
SHA1:	9C7BDC1EFDEC073746AD9B7478F113D9EBD403EB
SHA-256:	2AA0603ADAA5058A1C118C8F2FAACD333D31112EC4C75689F765E4BC3AF69473
SHA-512:	38C7A641A232F2A67F10904716D13C137F08A0A19F47D209994FF63BFB198D8BB89075CD78BD23FF26427CFB3BDC53585EC33735A6FFF5E76834278D958AD1ED
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left.D..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.959095954912026
Encrypted:	false
SSDEEP:	6:aG1uSLF2du6szW4Rl1Ac2duJRl1Ow0Ld2du4LRl1uSLju6szWAK1Ow0Lru4FK1AC:qITMDIb6UIJTc6S6jO
MD5:	D8BA1E1B3F547F94CB059C8ACEC89297
SHA1:	71A5043CA3BF89FECA070431985C232E28940AAB
SHA-256:	62EE20B127F44C2D91BBCC9A232689DD3F1BC3359E606257BF3B115D4CBBDD2C
SHA-512:	5DA1E4DEB8518CD7AF202E7169F181683C74A83F62D98A36DEB45A03E14F384410633017D16CCBB6E216904F40AC782D7BE97940EACAB7D60B2D54CB7DBAEDC9
Malicious:	false
Preview:	IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	43052
Entropy (8bit):	4.120190601260142
Encrypted:	false
SSDEEP:	768:yJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf9:yhXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dy
MD5:	57A89F49FD0EE39606E927B96B00CFE5
SHA1:	5D94926CAF2BE0284B0B4CB7E69ECFA7A9A63284
SHA-256:	8B4D56464B9F2050B89134F7BCC8CD0FAFE946CE062F320915B0404685BDA111
SHA-512:	186F50C78EBD96CB12E8F7D5DF249AFBBA3C71E5DF96AB4F293DB2AC99593459F634C0BFA3B1C2FF34063819894FB9F446000110069B1DE2DD63B47874956E7E
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\progress.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.740550563860751
Encrypted:	false
SSDEEP:	6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukAh:csIrqar1sIroarg
MD5:	86B3EBFBD934B66842048F0AA241E5C5
SHA1:	F770786C29D12D8C33B975EF2BAAD6D59A90F7CF
SHA-256:	4AEDBF26E568E62B47517E91FBCC818A5B95BD7FDB8A7DC5B826C0BD194077A6
SHA-512:	FE37AD98EC8DE62CE6E6A46E284450BBE19B7D8EB8C7B3B81BD06BA22EEBA487C2CEE8C3B37CD84FEAA09F8F39BDF532371B57FCCC7788A2F54EDA3390E58FD3
Malicious:	false
Preview:	IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia1\progressprereq.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	42687
Entropy (8bit):	4.076635616143556
Encrypted:	false
SSDEEP:	768:PoHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf/i:PoXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DJ
MD5:	0379D6212582C3FFF4E2E205B9585151
SHA1:	72BCF5C26E8270EC72F53EDC69D970E65CEE7229
SHA-256:	9495AE09659EA231157D576BF325CF8A55C191A493CF9EA39979CBC3497B281B
SHA-512:	D65059609CF44FDEA5134CC542835B7CD1FCB0873854D6BDB6A15D53737CD090F65CA119D81A0D3DCA5E0289E666395E140564B457870BDFD5A6334EBE41BE0C
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	3.1261873313705286
Encrypted:	false
SSDEEP:	768:KGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfjE:K+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Db
MD5:	92B2E967740B9A9566132617654F99CE
SHA1:	9E5CD494173A9BABFC520E085B66CAD832FA9263
SHA-256:	4CB5450E2366EB03855CB1890C84245BD21975B353807F820C461F56577E02D1
SHA-512:	233442A840DBCC4B37FF40CE8B97E2B4A157043A8B552236B2A24BA0DB18AA38CCA99B2F257272DA577793B129C047895D46A68214074D977E6930571974A3C4
Malicious:	false
Preview:	...TFRMDESIGN.0..\|..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\readme.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32180
Entropy (8bit):	3.176260859175472
Encrypted:	false
SSDEEP:	768:5UVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfA:5UdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5F
MD5:	56BAD53F5F88A0340D5835A37CCC33C5
SHA1:	943A88F953CD36E9F79B6681BDB3949071F60188
SHA-256:	7BEB6D4F0AC884F33B9528E3C56BEE15E3D4BD33D16DE40F242B024CE68FC4B0
SHA-512:	79AD20CD678C8C3F9A6571BEBDAC570B7167813310C44BEC1D67EC881F9FFC843965FF0B047F31E154A616B2E917A291DD8765B217674A963A7FCD57C20737C5
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!.

C:\Users\user\AppData\Local\Temp\mia1\registration.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.56478131967351
Encrypted:	false
SSDEEP:	6:aFiLYMtrk8FYMLYMtrk8W7qMtrkeqYRqMtrkt:+GYMtg+YMtgdmMtgpMtgt
MD5:	2FA9DDBED5C616D3838AD3934F3B2D7D
SHA1:	234B295897F4F8E6E991A5B362B5F5D8011EC24B
SHA-256:	4FB0948F1707CE29811F05CB06169D1360B08445AAA180EAB814EBADDF2BB101
SHA-512:	DAFE8B7BBF7BBFC6816707F131AB66924964576BD4BE5FD2986611212E7D7D436C71112CFCDD8EBF42F6C515700165D8305357DFA7030391E4B99E4998E91A70
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32912
Entropy (8bit):	3.310684742077839
Encrypted:	false
SSDEEP:	768:+tHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMb:+VXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DP
MD5:	C44488F6F633D32EA08F480FC760607C
SHA1:	6979D51D6398EFFF9742D09E022534A05AB9271A
SHA-256:	95C6B4CF234F726DDE2F63F9B162817A6807B3F33CC513C6FAF5E8BA0FB2A79A
SHA-512:	1C8EA5B2C0898DB712D9027E1B2B8AB8B569B520CEFE755B62C648EA9EBB8C720357DD4DB9E6F03D4C8143C524942D22AE9FD83F89EF5553E5E88AFEA0235E53
Malicious:	false
Preview:	...TFRMDESIGN.0.\|...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia1\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.629672896174913
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mth:+ff7kkKSHFmBBApVeNF
MD5:	5D78380EBDAD86764F26B73474DF4900
SHA1:	D2574CD9FB599E81C6099738D9D7974CE4039AFD
SHA-256:	DAA5742D80E19668753D435DA0937A4409D22AF73FBAF9DF22EC4CBC34FF5D45
SHA-512:	3533A9D8F4B1D8BD703856B150B8CBA99CA8CF55EF2182EB7B7326BF742C2B4B5CEA896B818FB690E0678689A8B452F22F5F548124D0B8302D776E8B2335B26D
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\setuptype.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33198
Entropy (8bit):	3.359763390973846
Encrypted:	false
SSDEEP:	768:DIHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf7q:DIXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	EFB592762376173C651EC1755E26DD1F
SHA1:	3ECBFC3F6058E6F827A2FD91A7AB94EB7E60A045
SHA-256:	ED39514751D8C9913F0A3C222F29FFC85F0EE3D107A222BD668DB96125190A03
SHA-512:	062BBBBBEC95FA272D2F35EACAF2DE3D8BD3D04E027FB34059CD25D0E482D525393D81AA7DD575BDB5970DA298A87C916283983E2B66208B6787747D72E2D8A5
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..

C:\Users\user\AppData\Local\Temp\mia1\startinstallation.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159671
Entropy (8bit):	1.9106205211543585
Encrypted:	false
SSDEEP:	192:mrRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4C/DEtdmpJ:m5I/SKi
MD5:	5773034B4AA211DB5CCCA92B4A346660
SHA1:	99948D4B79CFB184B076CC156F7656E4C3604438
SHA-256:	AF00C29E992E19D6DBE9D8DC5535BED62475F09B6E79EAE64B92E6B7CC801170
SHA-512:	E6B23477655045A65442E383748C6883AC0560CC3152DC8A5D19D8DAAE0BD5345B28392C804F3E1B0A3572410CB1AFCEB1EA2C195A976DD432CB0705B2398953
Malicious:	false
Preview:	...TFRMDESIGN.0..o..TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................................

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32908
Entropy (8bit):	3.3110543872756732
Encrypted:	false
SSDEEP:	768:qNHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfX1:q1XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5De
MD5:	5A8C8E081C329D3F53494AECEF81BD82
SHA1:	9F1037A2CF254FA932D2A642C4ABD84E0770E167
SHA-256:	FE73CBFCCECE99991601E653E816A1489425BC8701EEC2CF89724239316CC8CC
SHA-512:	9565DD95764D8B6E1761E323BD12420E84733CB6D35DDAADE755186E208C81308231C891CF00296E4F2FE7493D7E9DEE04A68DA7624D8F69C49A2DAC4B865B01
Malicious:	false
Preview:	...TFRMDESIGN.0.x...TPF0.TfrmDesign.frmDesign.Left.u..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia1\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.823487220355037
Encrypted:	false
SSDEEP:	6:aoqLYMtrk8LTqMtrkegurusdrHE8Pud2dusdrHEt:jOYMtgQeMtg1dsdrHEUxIsdrHEt
MD5:	8ED569EB90D7EC0791C65F696B85AA4B
SHA1:	AA48F7BD2BA3A2F5DD63D25DA56A1039A18E7FB0
SHA-256:	ABF9F1E255935EC3BA966B8CDA6D129F93F28F43F8C805523B4846769C90F788
SHA-512:	3BDBBDF37199E6FEB281867FFDE480782905E0C24DB729DBF78D6FA0D92A363AA0CABBE20303E06D1327A24C3142F0EF72F8B0AF1ED268652DB301407A4F5926
Malicious:	false
Preview:	IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia1\welcome.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159591
Entropy (8bit):	1.9059323470293204
Encrypted:	false
SSDEEP:	192:26Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBH1qw3cmrw:2QI/VnP
MD5:	C61886A33BF58C3BC38FA869019DA28E
SHA1:	C2E1B87CCBD13CBE8AFB4FC278A5BA0635C97279
SHA-256:	39056A7647F8135EDF8D8D80F81C53153CCE7E5BCC858ECC81BE6F0075692A26
SHA-512:	65EDBD0675A8282ECD0CCD74BDA2F458D222EAFA5BF29BE61F5F081D3FB53B38797B57BBF78C544771F362ED6F03929FEAB19C2E6928222AAD8BC1A53DF81263
Malicious:	false
Preview:	...TFRMDESIGN.0.So..TPF0.TfrmDesign.frmDesign.Left.+..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia1\wizard.dfm

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31822
Entropy (8bit):	3.1036618557972493
Encrypted:	false
SSDEEP:	768:sHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfU:snXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	01216764772CEB5308A494AFD9D73C37
SHA1:	88A301C9F21316D7AA3B909C3EF18A3F3EC164F7
SHA-256:	EC6130DCA3F4C1AF10559659024F6A5DC97D8B31E415715CF5C9D662BAC5743F
SHA-512:	6E3399DCD1A3EC38045FF360E53FBC836CDCBC763AABFFC9253F07F9A9683E2D605F088E885BE0254096430601F484740240D739110E557C458BE0851868E7BA
Malicious:	false
Preview:	...TFRMDESIGN.0.:\|..TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\TechkonDriver64Bit.msi

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315743880506391
Encrypted:	false
SSDEEP:	12288:+to45BKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:+to4vl5BqPA2fc7wMz7
MD5:	B807BD86405509D80EFA5DA0F8E0EFD6
SHA1:	6826E0429813D0AB446ECF2CE56BD0A14B701BE0
SHA-256:	81C9666B260B0CBD8B10F253CEAA699AB606BB8BE83946F4B253B153E11336FC
SHA-512:	4D6F9E7B7B2ED6ADF7BC74A65FA1C583756DF80680F97CACB5E2C94BC3A4C2296636C900325DFD4DBEBB2EE031305D6F3CE245D41481AB150DBC331F2BFA1E52
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Users\user\AppData\Local\Temp\mia2\componentstree.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32879
Entropy (8bit):	3.303772475257304
Encrypted:	false
SSDEEP:	768:VDHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfwE:VDXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DA
MD5:	7ABD6BD2B201E76EA624B72EC854E178
SHA1:	B74ECA13809A2439B0A8B769328247EED6ECA6CC
SHA-256:	B7E2337DDFE813C051D10B5CBBBBDC7FCD0EEF4B5B2621C3A77D6B91743C0F4D
SHA-512:	66AF2C8901D8B421C1BC1265CBC8495E19C2346BF8B97D280079E1200578D450B6DEA570B712D350D5BE0A8B88A2615BE4075008D85CCA3CCF5D28A4D9194A9E
Malicious:	false
Preview:	...TFRMDESIGN.0.[...TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\destination.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32756
Entropy (8bit):	3.2836876237576345
Encrypted:	false
SSDEEP:	768:XyHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfn:X6XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DU
MD5:	BF3263127CD771470559490ADB76647B
SHA1:	8971CB4959D1BCA4A0EC48F3186309B00E16261B
SHA-256:	4811574E264AEB0927806A9A953CEA2A903ED18C36A34A10B67E40B99CA1670F
SHA-512:	9AF82B1F3EB3E735E2434BA803C1FC6D13BC1866A73D9F0FF466A23A5761291DD00A6C0D57BD24CE6CC2DCD0ACC16E863A2F30A41FC4BBBD041578F85AF6AD27
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\finish.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	161047
Entropy (8bit):	1.9896602276153565
Encrypted:	false
SSDEEP:	192:E3Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CWNux1uAw1Dmi:EtI/gWf
MD5:	5F7AE8AAAC7F8E1E811BE95B187ABB10
SHA1:	C34C69B5AE6B4B2EFAE3236C386F2B0388F815A8
SHA-256:	984A34337FC921BCCBA721B8361D3806459D2F37CBF117F5CC35D6BD0D6FEF6D
SHA-512:	0A6F8E499686102AD85DD411958B3417A4E758FAC61A1D883420490AABDEF0F6CECED358997F83AB84FF7DC2D01A3E90903C899ED382B97165CF019B8C213709
Malicious:	false
Preview:	...TFRMDESIGN.0..u..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\finish.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1561
Entropy (8bit):	5.018115004625162
Encrypted:	false
SSDEEP:	24:UuikSi+nfi0ZiFuEai/pZSruicvSi+pipUivuNsIi/pEaiDatfi/pTvSgREii/pH:U5ExAGVPbu1ZRMfkf3faWYt
MD5:	2FE4E500443ECB1E27A767BEE9A18C63
SHA1:	887A5789CDAC46BEA2829870DF02AD6B87A92270
SHA-256:	6492FEB41031C64C70FA8FABAABCCDE4846F9438B017D152C68C4B356C6A167A
SHA-512:	9475EB0E7509493A23DEA491CFA0A9A1DB0D339C216F1E38512DF18A74D80C69B6C8CE9C10131047227FFA3E979D5D6F144748569CFD9209C47977D770D94DD4
Malicious:	false
Preview:	IF (checkSuccess.Caption = COMPLETE) THEN textComplete.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN textReboot.Visible := True;..IF (checkSuccess.Caption = CANCEL) THEN textCancelled.Visible := True;..IF (checkSuccess.Caption = ERROR) THEN textError.Visible := True;..IF (checkSuccess.Caption = COMPLETE) THEN RunNow.Visible := True;..IF (checkRemove.Caption = TRUE) THEN textRemove.Visible := True;..IF (checkSuccess.Caption = REBOOT) THEN RebootNow.Visible := True;..IF (checkSuccess.Caption <> COMPLETE) THEN textComplete.Visible := False;..IF (checkSuccess.Caption <> REBOOT) THEN textReboot.Visible := False;..IF (checkSuccess.Caption <> CANCEL) THEN textCancelled.Visible := False;..IF (checkSuccess.Caption <> ERROR) THEN textError.Visible := False;..IF (checkSuccess.Caption <> COMPLETE) THEN RunNow.Visible := False;..IF (checkRemove.Caption <> TRUE) THEN textRemove.Visible := False;..IF (checkRemove.Caption = TRUE) THEN textComplete.Visible := Fal

C:\Users\user\AppData\Local\Temp\mia2\licensecheck.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32086
Entropy (8bit):	3.1568876532608567
Encrypted:	false
SSDEEP:	768:PGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfp:P+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DC
MD5:	D5DF18B96E3A0E9DA52766BDEB603E4B
SHA1:	A1D313F08A9B663F8DB7BCB258EFA616BB2618DB
SHA-256:	C1E2B73702BE7EA8E2BB9CEC1F9D210757D67EB950D8A22EA39E0E2C5F9AF6B0
SHA-512:	AB60CE2806739B62EC063FABA81A17CFEEA3CFCD546E9DD8F486DA3491DF3BB76C7020E35B5C2898A923736672E3AE9CA2400978DCBFBD8B75E76B579B85FED1
Malicious:	false
Preview:	...TFRMDESIGN.0.B}..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\licensecheck.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\mDIFxEXE.dll

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1316352
Entropy (8bit):	6.662123826541052
Encrypted:	false
SSDEEP:	24576:htJHEI7Kl/eZfZblU8u+noMRBqSPSUO9z8mF36X+huHcN2:rkl6PoMRMSSzy+hwcN2
MD5:	595209D10BD0EC1B01F8AC31195E7902
SHA1:	849F59A743DE094C7CF05C7F89B0ED22309B619C
SHA-256:	8D67E430AB5300BBA92B1D1B45D2E87C13E8B0D61A75D02A70BC203696430534
SHA-512:	3AA7C32A3BC9F0A1E5D4B67B657A216131FBDD62E5794403D01FBBCA663420D861460DAEA6ECEA6F2C4268E67B1E2A71DEDE6E6A57FF041E34BFD3F3130EC328
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...X..V.....................j.....................Q....................................................................O........5.......T.............................................................................H.......^....................text...h........................... ..`.itext..T........................... ..`.data....M.......N..................@....bss....TS... ...........................idata...5.......6..................@....didata.^............0..............@....edata..O............:..............@..@.rdata...............<..............@..@.reloc...............>..............@..B.rsrc....T.......T..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia2\mMSIExec.dll

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1448448
Entropy (8bit):	6.68350408954223
Encrypted:	false
SSDEEP:	24576:KOG+2J9h3pr7waeMDJNGg/70Z6SVflSMBKS9uiNfGn83Zc5s/Z:Kp+QiaGN9SMcS95q83IgZ
MD5:	18B85C5A139BAEAFD89C70B8C6561A52
SHA1:	67033A74346E46C952CEE21EC1EE2C10CE8C5618
SHA-256:	33B5F0AED0E886DDEAD2D412BF811920FBD17B162BA6272C4B28CC879F380DB8
SHA-512:	2CC05FA8BB59B1B1CE24D25BDE62D85BEE273D4400EF9586ED2A2C513CD971CB52C9ADEDA8669CA257E2D8B8951D86C02D8E6506AE97BD85BA5AC45C4D724B2E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R..V.................n.........................Q....................................................................O....P...?...p...\.........................................................................h[...............................text....X.......Z.................. ..`.itext.......p.......^.............. ..`.data....Q.......R...r..............@....bss....XT...............................idata...?...P...@..................@....didata.............................@....edata..O...........................@..@.rdata..............................@..@.reloc.............................@..B.rsrc....\...p...\..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\mia2\maintenance.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	160192
Entropy (8bit):	1.9416958546631025
Encrypted:	false
SSDEEP:	192:TdRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4Cdtq69wTEmC+:TvI/Lw76
MD5:	68E84CD5CA646B0204CD019CC6B63DCD
SHA1:	B00E7D577E350F96149E5C14C6DDA8B05994462D
SHA-256:	ECCE7B76CEE8E1C10D828DC932F1BFDC782F1B599C1BF13651C21B73A5AE1A4A
SHA-512:	E848350BD35C9DD7B7AFA741BD4089763EA990B7F27AF96C3067E308A9AF812D83DB5F48E2EF8A6CE3E221036B1C76F0802A87DF9FC16CEB8C3B8E03619A1C85
Malicious:	false
Preview:	...TFRMDESIGN.0..q..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\prereq.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32211
Entropy (8bit):	3.1826203678135156
Encrypted:	false
SSDEEP:	768:iVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibfb:idXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Di
MD5:	1074D7C4D94AF399F1F6137AD183E70D
SHA1:	9C7BDC1EFDEC073746AD9B7478F113D9EBD403EB
SHA-256:	2AA0603ADAA5058A1C118C8F2FAACD333D31112EC4C75689F765E4BC3AF69473
SHA-512:	38C7A641A232F2A67F10904716D13C137F08A0A19F47D209994FF63BFB198D8BB89075CD78BD23FF26427CFB3BDC53585EC33735A6FFF5E76834278D958AD1ED
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left.D..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\prereq.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.959095954912026
Encrypted:	false
SSDEEP:	6:aG1uSLF2du6szW4Rl1Ac2duJRl1Ow0Ld2du4LRl1uSLju6szWAK1Ow0Lru4FK1AC:qITMDIb6UIJTc6S6jO
MD5:	D8BA1E1B3F547F94CB059C8ACEC89297
SHA1:	71A5043CA3BF89FECA070431985C232E28940AAB
SHA-256:	62EE20B127F44C2D91BBCC9A232689DD3F1BC3359E606257BF3B115D4CBBDD2C
SHA-512:	5DA1E4DEB8518CD7AF202E7169F181683C74A83F62D98A36DEB45A03E14F384410633017D16CCBB6E216904F40AC782D7BE97940EACAB7D60B2D54CB7DBAEDC9
Malicious:	false
Preview:	IF (checkWINST.Caption <> TRUE) THEN WINST.Visible := True;..IF (checkJS.Caption <> TRUE) THEN JS.Visible := True;..IF (checkDotNET.Caption <> TRUE) THEN dotNET.Visible := True;..IF (checkWINST.Caption = TRUE) THEN WINST.Visible := False;..IF (checkDotNET.Caption = TRUE) THEN dotNET.Visible := False;..IF (checkJS.Caption = TRUE) THEN JS.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia2\progress.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	43052
Entropy (8bit):	4.120190601260142
Encrypted:	false
SSDEEP:	768:yJHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf9:yhXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Dy
MD5:	57A89F49FD0EE39606E927B96B00CFE5
SHA1:	5D94926CAF2BE0284B0B4CB7E69ECFA7A9A63284
SHA-256:	8B4D56464B9F2050B89134F7BCC8CD0FAFE946CE062F320915B0404685BDA111
SHA-512:	186F50C78EBD96CB12E8F7D5DF249AFBBA3C71E5DF96AB4F293DB2AC99593459F634C0BFA3B1C2FF34063819894FB9F446000110069B1DE2DD63B47874956E7E
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\progress.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.740550563860751
Encrypted:	false
SSDEEP:	6:a3jF2duukAiRcjjuukTDoRcjF2duukTDQTjjuukAh:csIrqar1sIroarg
MD5:	86B3EBFBD934B66842048F0AA241E5C5
SHA1:	F770786C29D12D8C33B975EF2BAAD6D59A90F7CF
SHA-256:	4AEDBF26E568E62B47517E91FBCC818A5B95BD7FDB8A7DC5B826C0BD194077A6
SHA-512:	FE37AD98EC8DE62CE6E6A46E284450BBE19B7D8EB8C7B3B81BD06BA22EEBA487C2CEE8C3B37CD84FEAA09F8F39BDF532371B57FCCC7788A2F54EDA3390E58FD3
Malicious:	false
Preview:	IF (TestRemove.Caption <> TRUE) THEN CaptionInstall.Visible := True;..IF (TestRemove.Caption = TRUE) THEN CaptionUninstall.Visible := True;..IF (TestRemove.Caption <> TRUE) THEN CaptionUninstall.Visible := False;..IF (TestRemove.Caption = TRUE) THEN CaptionInstall.Visible := False;..

C:\Users\user\AppData\Local\Temp\mia2\progressprereq.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	42687
Entropy (8bit):	4.076635616143556
Encrypted:	false
SSDEEP:	768:PoHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf/i:PoXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DJ
MD5:	0379D6212582C3FFF4E2E205B9585151
SHA1:	72BCF5C26E8270EC72F53EDC69D970E65CEE7229
SHA-256:	9495AE09659EA231157D576BF325CF8A55C191A493CF9EA39979CBC3497B281B
SHA-512:	D65059609CF44FDEA5134CC542835B7CD1FCB0873854D6BDB6A15D53737CD090F65CA119D81A0D3DCA5E0289E666395E140564B457870BDFD5A6334EBE41BE0C
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top.w.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\readme.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	3.1261873313705286
Encrypted:	false
SSDEEP:	768:KGHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfjE:K+XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5Db
MD5:	92B2E967740B9A9566132617654F99CE
SHA1:	9E5CD494173A9BABFC520E085B66CAD832FA9263
SHA-256:	4CB5450E2366EB03855CB1890C84245BD21975B353807F820C461F56577E02D1
SHA-512:	233442A840DBCC4B37FF40CE8B97E2B4A157043A8B552236B2A24BA0DB18AA38CCA99B2F257272DA577793B129C047895D46A68214074D977E6930571974A3C4
Malicious:	false
Preview:	...TFRMDESIGN.0..\|..TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\readme.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.596663476123045
Encrypted:	false
SSDEEP:	3:ap5i6ApR2tuFRAdRLOEpe8vi5i6ApVuFRAdRLOEpe7Jv:aHi6GKuMtrk86i6euMtrkt
MD5:	26D8EB4CC3DEFA59F4E8FD1713EA2AB0
SHA1:	3D39A67AB169CA9F6EE0A9E2073142B5B75DD1E8
SHA-256:	D5DE1F79D4AEA2327A85379FB51AC3157907809043AA1E4AA34878E3E9787442
SHA-512:	5E3D9B5D65896A5C836BABDD892A306863342563FB2D41C56FB342A7E165F0319ECA6D24CE2825011EF0B109C304C7C4CB0DC4D0A493BC4281E32CE8970A1ACC
Malicious:	false
Preview:	IF (LicenseCheck.Checked = True) THEN Next.Enabled := True;..IF (LicenseCheck.Checked = False) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\registration.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32180
Entropy (8bit):	3.176260859175472
Encrypted:	false
SSDEEP:	768:5UVHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfA:5UdXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5F
MD5:	56BAD53F5F88A0340D5835A37CCC33C5
SHA1:	943A88F953CD36E9F79B6681BDB3949071F60188
SHA-256:	7BEB6D4F0AC884F33B9528E3C56BEE15E3D4BD33D16DE40F242B024CE68FC4B0
SHA-512:	79AD20CD678C8C3F9A6571BEBDAC570B7167813310C44BEC1D67EC881F9FFC843965FF0B047F31E154A616B2E917A291DD8765B217674A963A7FCD57C20737C5
Malicious:	false
Preview:	...TFRMDESIGN.0..}..TPF0.TfrmDesign.frmDesign.Left....Top.z.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label5.Left.(.Top.H.Width.8.Height...Caption..&User Name:.FocusControl..Name...TLabel.Label6.Left.(.Top.x.Width.A.Height...Caption..&Organization:.FocusControl..Company...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!.

C:\Users\user\AppData\Local\Temp\mia2\registration.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.56478131967351
Encrypted:	false
SSDEEP:	6:aFiLYMtrk8FYMLYMtrk8W7qMtrkeqYRqMtrkt:+GYMtg+YMtgdmMtgpMtgt
MD5:	2FA9DDBED5C616D3838AD3934F3B2D7D
SHA1:	234B295897F4F8E6E991A5B362B5F5D8011EC24B
SHA-256:	4FB0948F1707CE29811F05CB06169D1360B08445AAA180EAB814EBADDF2BB101
SHA-512:	DAFE8B7BBF7BBFC6816707F131AB66924964576BD4BE5FD2986611212E7D7D436C71112CFCDD8EBF42F6C515700165D8305357DFA7030391E4B99E4998E91A70
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\registrationwithserial.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32912
Entropy (8bit):	3.310684742077839
Encrypted:	false
SSDEEP:	768:+tHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfMb:+VXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DP
MD5:	C44488F6F633D32EA08F480FC760607C
SHA1:	6979D51D6398EFFF9742D09E022534A05AB9271A
SHA-256:	95C6B4CF234F726DDE2F63F9B162817A6807B3F33CC513C6FAF5E8BA0FB2A79A
SHA-512:	1C8EA5B2C0898DB712D9027E1B2B8AB8B569B520CEFE755B62C648EA9EBB8C720357DD4DB9E6F03D4C8143C524942D22AE9FD83F89EF5553E5E88AFEA0235E53
Malicious:	false
Preview:	...TFRMDESIGN.0.\|...TPF0.TfrmDesign.frmDesign.Left....Top.v.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\mia2\registrationwithserial.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	4.629672896174913
Encrypted:	false
SSDEEP:	12:+GYMtg+YMtgPt0YMtgPrYMtgP0ZYMtgPpDYMtgPuYMtgdmMtgpMtg6tkMtg63Mth:+ff7kkKSHFmBBApVeNF
MD5:	5D78380EBDAD86764F26B73474DF4900
SHA1:	D2574CD9FB599E81C6099738D9D7974CE4039AFD
SHA-256:	DAA5742D80E19668753D435DA0937A4409D22AF73FBAF9DF22EC4CBC34FF5D45
SHA-512:	3533A9D8F4B1D8BD703856B150B8CBA99CA8CF55EF2182EB7B7326BF742C2B4B5CEA896B818FB690E0678689A8B452F22F5F548124D0B8302D776E8B2335B26D
Malicious:	false
Preview:	IF (Name.Text <> ) THEN Next.Enabled := True;..IF (Company.Text <> ) THEN Next.Enabled := True;..IF (Serial1.Text <> ) THEN Next.Enabled := True;..IF (Serial2.Text <> ) THEN Next.Enabled := True;..IF (Serial3.Text <> ) THEN Next.Enabled := True;..IF (Serial4.Text <> ) THEN Next.Enabled := True;..IF (Serial5.Text <> ) THEN Next.Enabled := True;..IF (Name.Text = ) THEN Next.Enabled := False;..IF (Company.Text = ) THEN Next.Enabled := False;..IF (Serial1.Text = ) THEN Next.Enabled := False;..IF (Serial2.Text = ) THEN Next.Enabled := False;..IF (Serial3.Text = ) THEN Next.Enabled := False;..IF (Serial4.Text = ) THEN Next.Enabled := False;..IF (Serial5.Text = ) THEN Next.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\setuptype.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	33198
Entropy (8bit):	3.359763390973846
Encrypted:	false
SSDEEP:	768:DIHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5Dmoibf7q:DIXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	EFB592762376173C651EC1755E26DD1F
SHA1:	3ECBFC3F6058E6F827A2FD91A7AB94EB7E60A045
SHA-256:	ED39514751D8C9913F0A3C222F29FFC85F0EE3D107A222BD668DB96125190A03
SHA-512:	062BBBBBEC95FA272D2F35EACAF2DE3D8BD3D04E027FB34059CD25D0E482D525393D81AA7DD575BDB5970DA298A87C916283983E2B66208B6787747D72E2D8A5
Malicious:	false
Preview:	...TFRMDESIGN.0.....TPF0.TfrmDesign.frmDesign.Left....Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TLabel.Label4.Left.(.Top.H.Width.I..Height.!.AutoSize..Caption..Please select a setup type..WordWrap....TBevel.Bevel2.Left...Top.:.Width....Height...Shape..bsTopLine...TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP*.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..

C:\Users\user\AppData\Local\Temp\mia2\startinstallation.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159671
Entropy (8bit):	1.9106205211543585
Encrypted:	false
SSDEEP:	192:mrRfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4C/DEtdmpJ:m5I/SKi
MD5:	5773034B4AA211DB5CCCA92B4A346660
SHA1:	99948D4B79CFB184B076CC156F7656E4C3604438
SHA-256:	AF00C29E992E19D6DBE9D8DC5535BED62475F09B6E79EAE64B92E6B7CC801170
SHA-512:	E6B23477655045A65442E383748C6883AC0560CC3152DC8A5D19D8DAAE0BD5345B28392C804F3E1B0A3572410CB1AFCEB1EA2C195A976DD432CB0705B2398953
Malicious:	false
Preview:	...TFRMDESIGN.0..o..TPF0.TfrmDesign.frmDesign.Left....Top.~.HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8.....................................................

C:\Users\user\AppData\Local\Temp\mia2\startmenu.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	32908
Entropy (8bit):	3.3110543872756732
Encrypted:	false
SSDEEP:	768:qNHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfX1:q1XQ1NmO7ZDrkqzM+KGk1ccHq7kJT5De
MD5:	5A8C8E081C329D3F53494AECEF81BD82
SHA1:	9F1037A2CF254FA932D2A642C4ABD84E0770E167
SHA-256:	FE73CBFCCECE99991601E653E816A1489425BC8701EEC2CF89724239316CC8CC
SHA-512:	9565DD95764D8B6E1761E323BD12420E84733CB6D35DDAADE755186E208C81308231C891CF00296E4F2FE7493D7E9DEE04A68DA7624D8F69C49A2DAC4B865B01
Malicious:	false
Preview:	...TFRMDESIGN.0.x...TPF0.TfrmDesign.frmDesign.Left.u..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o..

C:\Users\user\AppData\Local\Temp\mia2\startmenu.dfm.miaf

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.823487220355037
Encrypted:	false
SSDEEP:	6:aoqLYMtrk8LTqMtrkegurusdrHE8Pud2dusdrHEt:jOYMtgQeMtg1dsdrHEUxIsdrHEt
MD5:	8ED569EB90D7EC0791C65F696B85AA4B
SHA1:	AA48F7BD2BA3A2F5DD63D25DA56A1039A18E7FB0
SHA-256:	ABF9F1E255935EC3BA966B8CDA6D129F93F28F43F8C805523B4846769C90F788
SHA-512:	3BDBBDF37199E6FEB281867FFDE480782905E0C24DB729DBF78D6FA0D92A363AA0CABBE20303E06D1327A24C3142F0EF72F8B0AF1ED268652DB301407A4F5926
Malicious:	false
Preview:	IF (MenuGroup.Text <> ) THEN Next.Enabled := True;..IF (MenuGroup.Text = ) THEN Next.Enabled := False;..IF (ISNT.Caption = TRUE) THEN AllUsers.Enabled := True;..IF (ISNT.Caption <> TRUE) THEN AllUsers.Enabled := False;..

C:\Users\user\AppData\Local\Temp\mia2\welcome.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	159591
Entropy (8bit):	1.9059323470293204
Encrypted:	false
SSDEEP:	192:26Rfzvu9vJSm3IZ8Zgspkk4B9heXItzNGzOiOWEpap5PKo6Mmp4CBH1qw3cmrw:2QI/VnP
MD5:	C61886A33BF58C3BC38FA869019DA28E
SHA1:	C2E1B87CCBD13CBE8AFB4FC278A5BA0635C97279
SHA-256:	39056A7647F8135EDF8D8D80F81C53153CCE7E5BCC858ECC81BE6F0075692A26
SHA-512:	65EDBD0675A8282ECD0CCD74BDA2F458D222EAFA5BF29BE61F5F081D3FB53B38797B57BBF78C544771F362ED6F03929FEAB19C2E6928222AAD8BC1A53DF81263
Malicious:	false
Preview:	...TFRMDESIGN.0.So..TPF0.TfrmDesign.frmDesign.Left.+..Top....HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.:..Picture.Data..i...TBitmap~i..BM~i......6...(.......:...........He..................V-..a8..`9..b=..nD..yJ..zL...S..d@..gC..jE..jF..mH..rL..tK..sM..zQ..kG .mI .lI%.rN$.tO&.pN).{R#.{U .{S$.rP.tP).sR..{W..}Y.vU2.\|Z2.yY6.}[5.zZ8.}^;..X...V...[...`...f...a...f...l...o...z...\|...r...z...q...w...\|...\#..X'..]$..Y)..[,.._/..^4..e'..h#..i%..l+..t...d2..b4..f6..e:..g=..h?..j<..l<..q<..~)..\|1..}8..eD..kF..oJ..mA..sC..rD..uH..xM..xS..}V..zJ.................../...3...4...?...<...1...6...8....................................................

C:\Users\user\AppData\Local\Temp\mia2\wizard.dfm

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	JPEG XL codestream
Category:	dropped
Size (bytes):	31822
Entropy (8bit):	3.1036618557972493
Encrypted:	false
SSDEEP:	768:sHHXQ1NmO7ZDrkqzM+KGlm1ccHq7kBTT5DmoibfU:snXQ1NmO7ZDrkqzM+KGk1ccHq7kJT5DB
MD5:	01216764772CEB5308A494AFD9D73C37
SHA1:	88A301C9F21316D7AA3B909C3EF18A3F3EC164F7
SHA-256:	EC6130DCA3F4C1AF10559659024F6A5DC97D8B31E415715CF5C9D662BAC5743F
SHA-512:	6E3399DCD1A3EC38045FF360E53FBC836CDCBC763AABFFC9253F07F9A9683E2D605F088E885BE0254096430601F484740240D739110E557C458BE0851868E7BA
Malicious:	false
Preview:	...TFRMDESIGN.0.:\|..TPF0.TfrmDesign.frmDesign.Left....Top...HelpType..htKeyword.HelpKeyword..passingvariables.BorderIcons..biSystemMenu.biMinimize..BorderStyle..bsSingle.Caption..$TITLE$.ClientHeight.h..ClientWidth....Color..clBtnFace.Font.Charset..DEFAULT_CHARSET.Font.Color..clWindowText.Font.Height...Font.Name..Tahoma.Font.Style...OldCreateOrder..Position..poDesigned.PixelsPerInch.`.TextHeight....TImage.Image1.Left...Top...Width....Height.;.Picture.Data.~w...TBitmaprw..BMrw......6...(.......;...........<s..................V-..^4..^6.._8..g;..a9..oB..xI..iB..gB..rK..nJ#.qN(.rP.wT(.sQ,.uT/.wV2.}[1.zY6.~\5.\|\9..P...W...^..._...e...c...i...l...s...{...y...z...\|.......Z!.._2..i<..dB..jJ..mM..sF..zO..}O..sU..uW..uX..z^..}P..}a..........................................................).....!..!..$..&..(....-..<..1..4..7..;...Z...j...l...m...v...y...~...~..A..F..F..M..I..M..P..Q..T..[..]..X..m..d..w...}..r..a..n..m...Z...]...e...b...j...o...

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET2550.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET2571.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\SET25A1.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9CD2.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9D12.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\SET9D61.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET81D8.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET8217.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\SET8257.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{55EA8940-B618-47BD-A642-20BFB2A64F78}

Download File

Process:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8060
Entropy (8bit):	5.464471468898182
Encrypted:	false
SSDEEP:	192:rZyVhFTzHjHP2CSIizfTQAkVxdUM47BjzFPaXp5MFrgD/tc6XVFXThjXT9lXAEj8:dyVhFTzHjHP2CSIiz7QAkVxdUM47Bj5X
MD5:	9F49B8D570D061E87A7E813493003AB4
SHA1:	B30ADE0A13BACE18D24F380F9201420104BC1974
SHA-256:	86997407997321AD6D18E258086E5AA2323EF18736A0B49A4A5A1DDE084CD608
SHA-512:	F9BC3DE550159DA045794E424FABA056E7AB37DBE23215701A8F9F43367661F73CE703AC1E6EDF22CC8D3E4E312014BA169C444290E87DA054C18A1304D564D3
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\{CDCC2~1\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\..$ex..A76FCA102..FALSE..$ex..A150AC403..FALSE..$ex..A1ABF3862..FALSE..$ex..A502E833A..FALSE..$ex..ACE56FB43..FALSE..$ex..A52B152B3..FALSE..$ex..AC0AC9330..FALSE..$ex..AE09F5A5F..FALSE..$ex..AF2F92670..FALSE..$ex..A94312164..FALSE..$ex..A5809A5D8..FALSE..$ex..A56A7DD7A..FALSE..$ex..A1A9DA512..FALSE..$ex..A84FEA59D..FALSE..$ex..A849003A2..FALSE..$ex..A98500B5D..FALSE..$ex..A4F27760E..FALSE..$ex..A4D56F533..FALSE..$ex..A7AA455DC..FALSE..$ex..AE1318D92..FALSE..$ex..A66980B9F..FALSE..$ex..A9167C40A..FALSE..$ex..A15F69ECD..FALSE..$ex..AB06B5044..FALSE..$ex..A66E41FEB..FALSE..$ex..A9E7D6EA9..FALSE..$ex..AB258770..FALSE..$ex..AB5CD4D0..FALSE..$ex..A537BC2C1..FALSE..$ex..A5D1665DA..FALSE..$ex..A6EB99A04..FALSE..$ex..AF5C9AD93..FALSE..$ex..A21D6E643..FALSE..$ex..A63D6488F..FALSE..$ex..AF835DFEA..FALSE..$ex..A9115C352..FALSE..$ex..A76FCA102..TRUE..$ex..P76FCA102_1..C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens..$

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET695E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET699E.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\SET69DD.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Download File

Process:	C:\ProgramData\miaE9AF.tmp\TDService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6207
Entropy (8bit):	5.445328020722464
Encrypted:	false
SSDEEP:	192:86NgV1JraG6XVFGVhjXy9hXATNiFSJLOV:tca9XVFGVEARiFSJyV
MD5:	6666B907D613082581C25DDA1982F049
SHA1:	618AECD9FEB5D7472884994E815CD3D1F135724C
SHA-256:	787D0927ABD1DEDF96B539D1E70B36BB1DDE2D266DC48BE99DE4F96C96F4637D
SHA-512:	E4CE433700587FA1D0A50D5D54733E55C9AC161F9EC651785F63E8E65A698FEFB91C6FF4C792F7F1958B8286ADBF4037009910B3F671A8A79B2DC183ABC37B92
Malicious:	false
Preview:	SourceDir..C:\PROGRA~3\{C39D0~1\..$ex..MEDIAPACKAGEPATH..\PROGRA~3\..$ex..AEDD97940..FALSE..$ex..A3CE6DECE..FALSE..$ex..A34E6DE3C..FALSE..$ex..A25D64044..FALSE..$ex..A3476C065..FALSE..$ex..A8135F827..FALSE..$ex..A8808A0B2..FALSE..$ex..ACC3273D..FALSE..$ex..AA913E6AF..FALSE..$ex..ACECD985D..FALSE..$ex..AC5D9D236..FALSE..$ex..A1A2661C4..FALSE..$ex..AC64028C1..FALSE..$ex..A3CEB12CD..FALSE..$ex..A1872974D..FALSE..$ex..AD4D85249..FALSE..$ex..AEACB8D8..FALSE..$ex..A7C4CDFEC..FALSE..$ex..A95FFAA1..FALSE..$ex..AF0FC8706..FALSE..$ex..AD7FB24C5..FALSE..$ex..A86D611ED..FALSE..$ex..AEDD97940..TRUE..$ex..PEDD97940_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A3CE6DECE..TRUE..$ex..P3CE6DECE_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A34E6DE3C..TRUE..$ex..P34E6DE3C_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A25D64044..TRUE..$ex..P25D64044_1..C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK..$ex..A3476C0

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD4EA.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD529.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\SETD578.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3CC0.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3D00.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\SET3D30.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET5181.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET51C0.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\SET51F0.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB80B.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB85A.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\SETB89A.tmp

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.cat (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.inf (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.sys (copy)

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\DPINST.LOG

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	39898
Entropy (8bit):	3.728795323107343
Encrypted:	false
SSDEEP:	384:64S0ScS6VWCSlSNSddrgSBSpS9dwaSxS5SIlgoSWS+SIF9lS3S/SL9EOSUS8SGNC:6MW3rNwYgq9+E+x4V
MD5:	E94B7F6DFD11666219A32954D6375E91
SHA1:	2E0921802A3466DEE1BB4DF6F549FF9BC950868F
SHA-256:	CFA015173A944FE88DA609942AB9CE3BBC40C40F0498A7F21054B4E3BBEC73C7
SHA-512:	3EF7622EF4883CFAED484E9E799B76823034BBB1FF7EFDEA643E9788FB82F1A30D0981A14DB1DB5B9135B4C134A12DF7C487DEE5838D6D69591DDFAE2A802188
Malicious:	false
Preview:	..I.N.F.O.:. . . .............................................I.N.F.O.:. . . .0.3./.1.4./.2.0.2.4. .1.2.:.2.9.:.4.2.....I.N.F.O.:. . . .P.r.o.d.u.c.t. .V.e.r.s.i.o.n. .2...1...0...0.......I.N.F.O.:. . . .V.e.r.s.i.o.n.:. .6...2...9.2.0.0. .....I.N.F.O.:. . . .P.l.a.t.f.o.r.m. .I.D.:. .2. .(.N.T.).....I.N.F.O.:. . . .S.e.r.v.i.c.e. .P.a.c.k.:. .0...0.....I.N.F.O.:. . . .S.u.i.t.e.:. .0.x.0.1.0.0.,. .P.r.o.d.u.c.t. .T.y.p.e.:. .1.....I.N.F.O.:. . . .A.r.c.h.i.t.e.c.t.u.r.e.:. .A.M.D.6.4.......I.N.F.O.:. . . .I.n.t.e.r.a.c.t.i.v.e. .W.i.n.d.o.w.s. .S.t.a.t.i.o.n.....I.N.F.O.:. . . .C.o.m.m.a.n.d. .L.i.n.e.:. .'.C.:.\.P.R.O.G.R.A.~.3.\.{.C.D.C.C.2.~.1.\.O.F.F.L.I.N.E.\.m.D.I.F.x.I.D.E...d.l.l.\.x.6.4.D.P.I.n.s.t...e.x.e. . ./.S.W. ./.S.E. ./.E.L. ./.P.A.T.H. .C.:.\.P.R.O.G.R.A.~.1.\.\.T.E.C.H.K.O.~.1.\.T.E.C.H.K.O.~.1.\.D.E.N.S. ./.D. ./.S.A. ./.L.M. ./.F.'.....I.N.F.O.:. . . .D.P.I.n.s.t. .i.s. .n.o.t. .m.u.l.t.i.-.l.i.n.g.u.a.l.......I.N.F.O.:. . .

C:\Windows\INF\oem12.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem27.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem28.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem29.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem30.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem31.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem32.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\oem9.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	345082
Entropy (8bit):	5.027856870071611
Encrypted:	false
SSDEEP:	1536:JqXp4MG+qrW40i6FfveS15KKpEtPyMbC4hDR+EHmEDFYQZ8ZBie2bQx:JqCMpqaruHmEfe2bQx
MD5:	58730B25C331F7CBBCE05F76CDE83561
SHA1:	E230142802C8DEBB68D8DE7AC338311409906FBB
SHA-256:	F9DF72236F366543489BE1C92E0922BC181ABF1CAEF2E08A0FEC814BE4E28F46
SHA-512:	6C8797D1D88E5558C3F5F99652601A32536CEC58B6494883A3074D4B26F47E1082FD70E74785F0DA2AEFE5100FACAFF0CCAD81810E64049B5E029658E83A6882
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19042.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2021/09/03 00:40:02.500]....>>> [Setup Import Driver Package - C:\WINDOWS\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2021/09/03 00:42:46.054.. cmd: C:\WINDOWS\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 00:42:46.085.. pol: {Driver package policy check - exit(0x00000000)} 00:42:46.085.. sto: {Stage Driver Package: C:\WINDOWS\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 00:42:46.085.. inf: {Query Configurability: C:\WINDOWS\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 00:42:46.085.. inf:

C:\Windows\Installer\161fe31.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309158560991388
Encrypted:	false
SSDEEP:	12288:tZTHM43BKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:tFM4Rx5BqPA2fc7wMz7
MD5:	BB476839A65AB03B7419B1285080C884
SHA1:	9321332A351363696DF3F12FB8FDC602043CAA95
SHA-256:	FF54C9A79D8DBB85E232B5E9A5C3C8F5AE32558B65CDE7935084A4E705BB21D4
SHA-512:	9BF03E54FCBAF7FF7031155C16B59BF5AF039D3145AFEBAE7036A93552CA3621A40FDE80207F787D599C74AD366D5A116F50DE5374700658C8DFE85E6E8C3792
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\161fe35.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {C39D0F65-909B-4DBD-A3E7-FF81A783B41B}, Number of Pages: 200, Title: TECHKON Device Service, Subject: TECHKON Device Service Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	6.309158560991388
Encrypted:	false
SSDEEP:	12288:tZTHM43BKXsbzeDSJfQ8guBoN2KA2wKc7wMz7:tFM4Rx5BqPA2fc7wMz7
MD5:	BB476839A65AB03B7419B1285080C884
SHA1:	9321332A351363696DF3F12FB8FDC602043CAA95
SHA-256:	FF54C9A79D8DBB85E232B5E9A5C3C8F5AE32558B65CDE7935084A4E705BB21D4
SHA-512:	9BF03E54FCBAF7FF7031155C16B59BF5AF039D3145AFEBAE7036A93552CA3621A40FDE80207F787D599C74AD366D5A116F50DE5374700658C8DFE85E6E8C3792
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\161fe36.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315743880506391
Encrypted:	false
SSDEEP:	12288:+to45BKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:+to4vl5BqPA2fc7wMz7
MD5:	B807BD86405509D80EFA5DA0F8E0EFD6
SHA1:	6826E0429813D0AB446ECF2CE56BD0A14B701BE0
SHA-256:	81C9666B260B0CBD8B10F253CEAA699AB606BB8BE83946F4B253B153E11336FC
SHA-512:	4D6F9E7B7B2ED6ADF7BC74A65FA1C583756DF80680F97CACB5E2C94BC3A4C2296636C900325DFD4DBEBB2EE031305D6F3CE245D41481AB150DBC331F2BFA1E52
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\161fe39.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Revision Number: {CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}, Number of Pages: 200, Title: TechkonDriver64Bit, Subject: Techkon USB-Driver 64Bit Installation, Keywords: Installer, MSI, Database, Author: TECHKON GmbH, Comments: All rights reserved, Name of Creating Application: InstallAware, Security: 0, Template: x64;1033, Number of Words: 8
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	6.315743880506391
Encrypted:	false
SSDEEP:	12288:+to45BKXsbzzDSJsQ8guBoN2KA2wKc7wMz7:+to4vl5BqPA2fc7wMz7
MD5:	B807BD86405509D80EFA5DA0F8E0EFD6
SHA1:	6826E0429813D0AB446ECF2CE56BD0A14B701BE0
SHA-256:	81C9666B260B0CBD8B10F253CEAA699AB606BB8BE83946F4B253B153E11336FC
SHA-512:	4D6F9E7B7B2ED6ADF7BC74A65FA1C583756DF80680F97CACB5E2C94BC3A4C2296636C900325DFD4DBEBB2EE031305D6F3CE245D41481AB150DBC331F2BFA1E52
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%.......................................................................................................V........... ...!..."...#...$...&.......'...p...)...*...+...,...-...........0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...W...]...X...Y...Z...[...\...y...^..._...`...t...b...c...d...e...n...g...h...i...j...k...l...m...a...o.......q...r...s...u...v...w...x...........z...

C:\Windows\Installer\MSI1930.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSI19AE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI19FD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI1A2D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI1A6D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	16702
Entropy (8bit):	5.722525852747486
Encrypted:	false
SSDEEP:	384:ueRHUzdHmO0GgJVAu6qMNv1oDZkXtQMDmDIzqZ1+CmC/jFz5G6ci40F1e3i0iwA+:u/zM3y5XTb
MD5:	55BD5079DC9347432915BDE446DC8A40
SHA1:	2FE6AA406E4B8DB01151CA9C6B57661A467D311D
SHA-256:	49AB62755C75E19F58C2E089F416EFE338ECEA2AC8E6643D02E3286A54D88CB0
SHA-512:	9B5388EA5B3BC203D43B94EBCAF61447A3DA2268455A9C211E88B6BEF5DE97C807ABB50FA3770A6C7F7F64E0555961274444FE963F8DB98FB842C98AECC6C837
Malicious:	false
Preview:	...@IXOS.@.....@.cnX.@.....@.....@.....@.....@.....@......&.{55EA8940-B618-47BD-A642-20BFB2A64F78}..TECHKON Device Driver 64Bit..TechkonDriver64Bit.msi.@.....@.....@.....@........\PROGRA~3\&.{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Driver 64Bit......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@$....@.....@.]....&.{5702EAC5-033D-48B5-B83F-DEF9ECF4C262}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.sys.@.......@.....@.....@......&.{52B0046B-434A-4EA9-9AC7-766C93D4D3F6}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.inf.@.......@.....@.....@......&.{6D03A36D-9750-4B1E-8344-0CE7ACED2DE2}R.C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\SpectroDens\spectrodens_x64.cat.@.......@.....@.....@......&.{2B8BCB22-4191-4BD5-817D-B0123E06B87F}T.C:

C:\Windows\Installer\MSI28.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSI77.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11787
Entropy (8bit):	5.788440018842951
Encrypted:	false
SSDEEP:	192:KHw9S/Q1WOcI8skxoCyRR3E0cqiZ1rFsI92uBYPiGVAey24jW3:KHw9T1CyRRU0cqiZ1xh92UlFW3
MD5:	37DD08DF1DFA40201B229B676F909DD8
SHA1:	6ECE8FF47DBFDFDB918AA921D38F2D1CB85CC49E
SHA-256:	356C0F129F52A6FC2D652EA6000C909468E5EBCE27C672CB346F0662B96340CF
SHA-512:	9D2E76177D468EEAEAC83A28DE0249632A157C57FB07D983F79F332C9E012E40DC1A77730A084B9D83E73FBFD4D0144D13D191B1AB7237C96CE30F9E687311D2
Malicious:	false
Preview:	...@IXOS.@.....@.cnX.@.....@.....@.....@.....@.....@......&.{CD1E6019-47AE-4334-A91E-595BA68B6E06}..TECHKON Device Service..TDService.msi.@.....@.....@.....@........\PROGRA~3\&.{C39D0F65-909B-4DBD-A3E7-FF81A783B41B}.....@.....@.....@.....@.......@.....@.....@.......@......TECHKON Device Service......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{CD0C69EF-2B12-47ED-87B7-5A1DB20CBCD9}N.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss.@.......@.....@.....@......&.{4D6F449F-FA68-42B5-A305-16C45F308B8F}N.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss.@.......@.....@.....@......&.{96ED6BF5-4AA1-4668-AEEE-E5101CDF29BA}L.C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.@.......@.....@.....@......&.{672A692B-629D-4B2A-A63B-2E211EA7164C}N.C:\Program Files (x86)\TECHKON GmbH

C:\Windows\Installer\MSIFEFC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.443465180760872
Encrypted:	false
SSDEEP:	6144:zgj8g8Sy2AoNSlkJAiL9svGFXFPvA2wKcWQwMYW7rmk:zQ8guBoN2KA2wKc7wMz7
MD5:	89B5903624F9CDED346676E88F918693
SHA1:	162201E4E31FB327E0B16531C81041DC574A04A4
SHA-256:	851BB0A420E47AF2F49518FAE86E4B9755BD5DAA6E9EB3B2F1FC4585B6F05163
SHA-512:	FD2587EF52E43EC131E4D06A34306E038B85B98E9EE2866FFD117E906B019FBA6972B794BEC2A9E0FEF357E199A0D13E64A89D4356EA8BF6CAFD6A289B1B48A7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...>=xQ............................d........ ....@.....................................................................E............p...&.......................}...................................................................................text............................... ..`.itext..\|........................... ..`.data....,... ......................@....bss.....P...P.......8...................idata...............8..............@....didata..............J..............@....edata..E............L..............@..@.reloc...}.......~...N..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

C:\Windows\Installer\MSIFFA9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\MSIFFF8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.043448081977129
Encrypted:	false
SSDEEP:	1536:bzfplpotJ+Tc5x5XJAIu7+zc2X5X1DznQyrvDklgXUEfbSorHqSCdZQVTbe6Kion:bjbp4gcXsnuRfklg8orHqnzT9ioO
MD5:	6484BEE1546FEB56595EAACF5D019C55
SHA1:	CBFE2EBE0485E447F1887F52D5A3CFA480A8FBBE
SHA-256:	FB73F1E2A71635F6F1F10FB7C7B738E4CE5125C3841B1A656A5F2CD406BDDFB2
SHA-512:	538A1B8981BAF6F35FE58CC862FAA5AF27D68E93572C5E4EF6719E1CF4A9B1A4AC9E61FFA22EBC1E9AEC0FDEB88AF54FE8834B8C384B596A889C07E63C031ECE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...?=xQ.....................f......\|.............@.....................................................................D....`..................................d+..................................................Xb.......p.......................text............................... ..`.itext.............................. ..`.data...h...........................@....bss.....N...............................idata.......`......................@....didata......p......................@....edata..D...........................@..@.reloc..d+.......,..................@..B.rsrc................"..............@..@.....................4..............@..@................................................................................................

C:\Windows\Installer\SourceHash{55EA8940-B618-47BD-A642-20BFB2A64F78}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.8077247005115518
Encrypted:	false
SSDEEP:	24:JgXIf908zkGAu8HscELypUHOl050j9/ZVuNjJPUB//6FN:GS9zkwP6UW052y6//6v
MD5:	07CCE5AC6AD240342FDCC3131B884FC4
SHA1:	A0798EF650677ACDDAF1F722A71B86670421C090
SHA-256:	515CAFE7533D528879A9DF7DF66FAE05481881CAAC0976DF9599978FB121FBB3
SHA-512:	D90724276FA560E836DEABB34933F723651BB8A9AE7E03D716B096CBBBBE5D593DE2B4F9AF1AE9179A6514E97FE3224A60B88BD4EE3775735097759F1287911F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{CD1E6019-47AE-4334-A91E-595BA68B6E06}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.627908699439305
Encrypted:	false
SSDEEP:	24:JRXmIsc0d+RjcsiQs5hBFyTUksTQ+F/ymZU+/w/FD+utO7KvFN:zWxcJjcsmBITdsT2AKvv
MD5:	F88287AA89AD79DAD09F70592BD497B2
SHA1:	FE1AB5052AD09D63B0D2004EE910B15E70C2102B
SHA-256:	2D957E15375DCC3BECFF5BC2FAA36EE8BCEA9EE33A180C6A1EE0632B14457C9D
SHA-512:	40F32EB723B5C37B51699BF6CD6E87F0591303CF698E53BC742AE7F1034FCE4F1160338127CEEA8ED4C7CD9D35BD4871A53A39DCA6F3FF6DCD9145D62C21A2E9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4855112921180504
Encrypted:	false
SSDEEP:	48:C8PhbuRc06WXJGFT5vI4Xn3tZ/1Cfq6Oe0ZPfjOy:thb1dFTz33D/1CnfuPC
MD5:	92F06D61F100A3BD2B8C18EE665FF26E
SHA1:	DB96F68A66392E4227F4D3CC9539A1DAE43231F0
SHA-256:	4E582B7165F78BFE372470A0FF6640A9AB2F8840F1159D707CFCF5FA6D5324F2
SHA-512:	B8ED3D71DB489FA3540FDC0BF45A0AAB0DB9C4F408809FFABCABC0544502377ED0CC3DCEC1D0B5D093D0A2C450CA57E38A2245F0431801D68298B6C6F63FDAEC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	871608
Entropy (8bit):	5.412145162341004
Encrypted:	false
SSDEEP:	3072:76sAoN1IAMVcB6J3l7NPh7sOyQSiMbRolrNWG6x+Rkeov8Qj9lOx2s9OW1LRuuGi:TFfxq8RfKF0Dux6lvJ3c7v/3dgA/UM
MD5:	86CD1191E0A56EA4EC16D45F85266261
SHA1:	1ED30A2E88968249A304628CB811C451CDC7BE07
SHA-256:	B4AB76BD17592DB1BC93D15E552221DEB13B5AB75C28425AC716022816FC733E
SHA-512:	7C537262D5C2412939C99264A880ED5C13CB82DB368619B05637D2AAA52D585006A5BB1F9949412DAFF16B674A3EEA37EF7C19A76A29148DB4F24C9B4F0C19A6
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 09:59:37.236 [4684]: Command line: D:\wd\compilerTemp\BMT.i51yo0aa.beh\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 09:59:37.255 [4684]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 09:59:37.299 [4684]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 09:59:37.299 [4684]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 09:59:37.299 [

C:\Windows\SysWOW64\MSWINSCK.OCX

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124688
Entropy (8bit):	5.941729779329973
Encrypted:	false
SSDEEP:	3072:9PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+sB:9PBUyhsdEI2++M+RlTHYL
MD5:	E8A2190A9E8EE5E5D2E0B599BBF9DDA6
SHA1:	4E97BF9519C83835DA9DB309E61EC87DDF165167
SHA-256:	80AB0B86DE58A657956B2A293BD9957F78E37E7383C86D6CD142208C153B6311
SHA-512:	57F8473EEDAF7E8AAD3B5BCBB16D373FD6AAEC290C3230033FC50B5EC220E93520B8915C936E758BB19107429A49965516425350E012F8DB0DE6D4F6226B42EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].:@...........#......................... .....".................................W...............................i...............0...f...........................................................................................................text............................... ..`.data...P.... ....... ..............@....rsrc....g...0...p...0..............@....reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\TDSCON.ocx

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	5.853209211745096
Encrypted:	false
SSDEEP:	1536:YxeYFH0dtYcPdtYc0F9J174KlwOAYQog4wBYo4IYo4N65xpUV:YTFXNxF9j7j65xpUV
MD5:	9AA2C7DEAF5B8DBED62A60F723553858
SHA1:	6BFE53D07A3970523DC8C796EE24F392D2686BF7
SHA-256:	28D0E73EE5616C2A76829A0A430F465B598987B4798F6BA46234393E40167BA9
SHA-512:	AF2C404702563143B3ED6FC26C45D4E1CBB074F006420FF04F963C1F13783CA141C13D08918AFA9537A2DAABABC631C18DBB6562BC50AA3CB49294CCD00714F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......UBq..#...#...#...?...#..^....#..'....#.......#..Rich.#..........PE..L...Y..J...........!.........@......(........................................@......"J..........................................(.......D....................0..............................................X... .......(............................text............................... ..`.data...H...........................@....rsrc...D........ ..................@..@.reloc.......0.......0..............@..B2..H............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\USBIOCOM.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.031963137664287
Encrypted:	false
SSDEEP:	3072:LwlZ+P6imnm8mFmT73tgHnV53kAgcvzgRm1trohJkwh:cZ+6imnm8mFmT73krb6gonf
MD5:	CEC1791BEC45F9D86771AF4F24EAA3F4
SHA1:	1B806C9A7189C7801EF643C5AEA03CD6B0DEDCC4
SHA-256:	7878EB862C0A8AB0766236E6C2183FAC93A0C734276347A143B454E2FB8B4F58
SHA-512:	BF917BA4C20DB97685A4BFEA266ECE11C77286F9480E546007FC1D830E4DFBA0966F6B5B59D74AFC89713276BB899755DFABC8F3C42A8422E612401C761A9BE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.v.v.v.Y.v.v.Y.v...v"..v.v"..v.v.vE..v.Y.v..v.Y.v...v.Y.v...v.Y.v...vRich.v........PE..L...Q..K...........!.....`...P...............p......................................[...............................0................0..................................................................@............p..l............................text...._.......`.................. ..`.rdata...x...p.......p..............@..@.data....9....... ..................@....rsrc........0......................@..@.reloc..V'.......0..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\lcms.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.4058590918443175
Encrypted:	false
SSDEEP:	6144:U+l+8gbiTF32Cw0oSGWhuLuGser+VbGrIQL:idbgFmJSGWhWuGseapkr
MD5:	05D89328C51E732DE076DA05239D1D79
SHA1:	C89B8500D13D540D9F6D8FA651F13E2F9990DECE
SHA-256:	EE0BC472EC26CE050315AAAE1D85AE51BAF17E8A2A548E3161DED665CF324DD1
SHA-512:	9EFE29F322A0A3049D0E5332C92A434B2F9797C0D3DB09414FCF8D6F5A01C4157716D5D252B38879312D5675712AD875B2A8D7E9407849CE1B992B94D5E50FF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9K!3}O`}O`}O`.5D`\|O`.6A``O`.5E`.O`.5\`xO`}N`3O`{.E`iO`.,I`\|O`..K`\|O`Rich}*O`........................PE..L......B...........!.....p..........w...................................................................................W.......<....`.......................p.......................................................................................text....k.......p.................. ..`.rdata...(.......0..................@..@.data...X........`..................@....rsrc........`......................@..@.reloc.......p... ... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA1A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA59.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\SETDA99.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155292171931641
Encrypted:	false
SSDEEP:	192:64JPCjTnYe+PjP3rTqavM+vmr9ZCspE+TMAr+YR:iPnYPL3qaLeMnw
MD5:	9C27BFE6E80B05E7DADB26DAD826984A
SHA1:	724DFF2E442DD2D17ED6D100E9FD2D93786C79B8
SHA-256:	C7045DFCCD4CF9D28999893C47CB4B28EA3AB0E8BD5C3C1ED7D4F3FE6EF2026F
SHA-512:	A8225CFA0FBB7800C30978ACCE5CD8C49F481EB9BFF0E99037C7A569D1286837A027F6CC85B35A2469E2258AE3B32DD4E20095980FC0FF2C7B2094C1BEC0523B
Malicious:	false
Preview:	0..`...H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......P.e...@.y.....V..140916104248Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.1.6.F.4.D.0.E.E.6.9.6.F.0.B.A.C.C.1.E.0.3.7.1.5.5.7.9.3.B.A.C.D.2.7.D.0.3.3.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........oM......qUy;..}.<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.19974129042694
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1l4fRb7JsIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTML4ftlTkV1nGkzA2
MD5:	54604542F5A3385064DE1524F57D21E0
SHA1:	C16F4D0EE696F0BACC1E037155793BACD27D033C
SHA-256:	A3D693423160DCE3A729F8E97AA0085D0731B9F57C7C2ECFA6C8ABEBF52C28B8
SHA-512:	967C9E400CB8C68560B01AB07629AF58403F9527377ABBBAC49E73A3D8CB9FFDE90EE772554700BC5F88D113B0AA9F19720D4AF2461635E52FFA77D6CB593932
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{06178e7f-c714-204a-9afb-f62978734989}\spectrojet_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET290A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET2939.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\SET2969.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7500
Entropy (8bit):	7.16354760210281
Encrypted:	false
SSDEEP:	192:N5PCjwnYe+PjP3rTqavM+vmr9ZCspE+TMAr+sMUYu4:yEnYPL3qaLeMnLQ4
MD5:	B3A76DE50584DD20EDB7A1320F7E6C06
SHA1:	6884659420A4A904975BE363B8B71197F35DF423
SHA-256:	6DB1061C1712E03CC45ADAC730AF50DFA7AB2B29F4A585A0A866573E0023D5F3
SHA-512:	5E33D07BC96082ED78EE9C45F8E4248E7AA8C872FB91D60A73623AFA593400CD47AB1F79A69166541206936156F3B0CE08E0B851561080E068F3E0288CA8072F
Malicious:	false
Preview:	0..H...H.........90..5...1.0...+......0.....+.....7......0...0...+.....7.....l...0E.B..y?t.....140516140009Z0...+.....7.....0..z0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..e0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RC.5.F.4.E.7.6.D.6.1.4.1.B.2.7.5.8.5.D.6.F.8.3.7.3.1.D.2.A.A.D.C.A.2.F.8.F.5.8.B...1..]0<..+.....7...1.0,...F.i.l.e........d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........maA.u...71.....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9694
Entropy (8bit):	5.199518545726912
Encrypted:	false
SSDEEP:	192:B8HvMWGtLZlAdwo3UqTMK4fRb7FsIVkTBgdvXnG4izeVtcw:B8H4l2tNTMK4ftRTkVEnGdzAf
MD5:	1CA510E30084F95389EF4EEB6D44398D
SHA1:	C5F4E76D6141B27585D6F83731D2AADCA2F8F58B
SHA-256:	0ED6EBAEC6DEAD6FDA901B3276715E9EC35FF757C02A27D3526ACC6EEFFEF457
SHA-512:	21ED2655F9FBDB7732B2DA8F5DF316BE4DAE80561209E49A58AAC4D69DFCF11A007A9565C3F78309DC6BC350A47F67BC4F4B559B2A8A5C340A7D60289CD243A5
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{28b6d34b-f8b1-234e-a714-2f9a63d90bcc}\dens_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBC8F.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBCCF.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\SETBD0E.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7528
Entropy (8bit):	7.161254074300881
Encrypted:	false
SSDEEP:	192:LYRINCjanYe+PjP3rTqavM+vmr9ZCspE+TMAr+DtJ:a+nYPL3qaLeMnD
MD5:	5C737957A4385512FD021458107C0CE6
SHA1:	F5815B5B9EFFA9C7B8850B84C504CC5487DB2D4C
SHA-256:	EFF94634DCAD8CF3D2F5633E58772368280D79B0C5DCC825D71256B70B07F37E
SHA-512:	DFC6F4074BA83AF03F50028A3B70D980272A139E56DA7994764F6F91A44742E7498C2BFF88485E2FDC86080FE99AED582ECE55D065AA9B2D731A6AAFC685DA4E
Malicious:	false
Preview:	0..d...H.........U0..Q...1.0...+......0.....+.....7......0...0...+.....7......-.'.g.H....E.`...140516140004Z0...+.....7.....0...0....R3.A.2.7.2.A.5.7.1.B.E.9.B.B.5.E.9.C.C.2.2.F.5.3.7.A.A.2.6.4.B.1.C.3.D.1.C.D.4.5...1..k0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........:'W..^../Sz.d....E0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..s0J..+.....7...1<0:...F.i.l.e.......(s.p.e.c.t.r.o.d.e.n.s._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	5.199048245781225
Encrypted:	false
SSDEEP:	192:B8HvMWGpLZlAdwo3UqTMw4fRb704sIVkTBgdhXnG48zeVtc24yr:B8Hil2tNTMw4ftw4TkVMnGVzAL
MD5:	5BE543804F4C61874D3CA9F979F78AD7
SHA1:	3A272A571BE9BB5E9CC22F537AA264B1C3D1CD45
SHA-256:	DA73278D43CD6EDA99F92C24CD6674C71238F2795CDA1B06DD2F8B0F263E1036
SHA-512:	520B1674F908B86D56E9679A201A34A31C2B8A792281542E4720DD87D1D2C5DEE87BB6F8469F624213C9A3BE55AC5973BF6B220FF7CC0C9EF77F9AA8412E8251
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{3fc825f5-b61a-994f-9bba-85cd6c4da8b7}\spectrodens_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET407A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET40A9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\SET40D9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.156208031117259
Encrypted:	false
SSDEEP:	192:jwn9PCj+nYe+PjP3rTqavM+vmr9ZCspE+TMAr+7+Yac:jjanYPL3qaLeMnOc
MD5:	16AC4FA94C22381E7A4A50141307A54D
SHA1:	D796A30A98D895D0BC49A09D0A6F63EABD81BD7A
SHA-256:	9E5588D557F378CB386D0414D21EA256C60D11DE9D1B915F671B260147B98498
SHA-512:	3FD8DDA6D71949791E1C2728E5B49EA81032BC5C0D3456DE7C4652479AE023FC5D65E0AF7773C2556F52039FC290C81FF1FBDA3709A5FA8CA81E657F932535EC
Malicious:	false
Preview:	0..p...H.........a0..]...1.0...+......0.....+.....7......0...0...+.....7......b.B...B..$......140516140010Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..y0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....R9.E.E.A.E.F.F.4.6.8.D.6.2.8.0.1.4.9.C.8.9.9.2.3.2.E.8.8.7.D.2.E.C.9.7.1.F.1.1.6...1..q0P..+.....7...1B0@...F.i.l.e........s.p.e.c.t.r.o.d.e.n.s._.i.r._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............h.(.I.#..}..q..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.200356426579818
Encrypted:	false
SSDEEP:	192:B8HvMWG5LZlAdwo3UqTMG4fRb7isIVkTBgdbXnG4+zeVtc2PdT:B8HMl2tNTMG4ft+TkVQnGpzAJ
MD5:	2AF89E9CB43E93768CA169CB76756123
SHA1:	9EEAEFF468D6280149C899232E887D2EC971F116
SHA-256:	303847238B729D0A2D49F93073AC882120FF112C93046845A855A3FC192D6A17
SHA-512:	43CFED37B4946FB95BD31A33D3EFCC273446FEB13D34593134AB1CB909ACF83FBAD1B5556F092CADA0B5AD3492E2976E010966259CC2E205678CC8620310845F
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{401fd0c5-2338-6643-b9e5-a41648c52a8f}\spectrodens_ir_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA1A5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA1D4.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\SETA224.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.160287296745998
Encrypted:	false
SSDEEP:	192:hF8WkNCjInYe+PjP3rTqavM+vmr9ZCspE+TMAr+VykqZ:T8a8nYPL3qaLeMnVy/
MD5:	F9A900E64BE138468DBACBC488511E8F
SHA1:	2F8F2A07A80DC53DEE2F1B687E50D71403C66C5B
SHA-256:	F0E7DD66F59AA78446C0A5D069F989792584D3BB8A47E69B161D278E43A58877
SHA-512:	BA85D4D138E497A447546937B637DD7504BFFDCD04B8026C729B87F2DAC095F9739D1B0F76BE90EF6A7D1D7B201B4B8574AE4F01BC65329BB12203671F253EB8
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....\5.k>..A....N....140516140005Z0...+.....7.....0...0....R1.2.F.2.C.9.7.D.E.F.8.3.A.5.A.2.A.E.E.2.6.3.E.A.3.E.7.6.1.E.E.2.8.C.8.5.B.3.1.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........}....c.>v....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......*s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.199812485547983
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTM84fRb7lsIVkTBgdJXnG4EzeVtc2gaj:B8HGl2tNTM84ftJTkVanG/zAl
MD5:	04ACD4E8BFA9089D2120AE8872190CB3
SHA1:	12F2C97DEF83A5A2AEE263EA3E761EE28C85B318
SHA-256:	D5E60140FC42A8C26566C5D99822F449ECC51C4D8AFF2235FABBD5767AC5E779
SHA-512:	22046E62109D752F0A3AB67962B70AE65925F3A897287EF64C59592BF11E7EC697F23FEB56AD43EDC8161F4CF144CFBA76421529C6ACA0DC9D523D762DD29DE9
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{7396bad8-7048-af42-b5d5-dc387736691c}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6D85.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6DB5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\SET6DE5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	7.155823358156326
Encrypted:	false
SSDEEP:	192:66ohNCjenYe+PjP3rTqavM+vmr9ZCspE+TMAr+0+:r6nYPL3qaLeMnf
MD5:	78FE95788DB8E3332DA03D9B86943407
SHA1:	1D9648350CD10A6C9FB33DC87F895C23E049FB8E
SHA-256:	B56D737983F4B59B34A0CAC7B748617DEFA159965FBEE3B693D767364FE641F0
SHA-512:	784EA0F012D53856668AE36F6CEFBCA3DBCADE69C20E6A3F42EC899535E3CA774D8C23FC03CBBAB0B4E1DC25DF0029C4C409A2E02D085896BB6D42252CDDED9A
Malicious:	false
Preview:	0..`..*.H.........Q0..M...1.0...+......0.....+.....7......0...0...+.....7......8d&?u.@.....`o...140516140007Z0...+.....7.....0...0....R5.6.1.3.1.A.E.B.2.C.6.E.7.9.4.7.E.1.F.B.7.C.B.2.8.2.6.3.8.B.5.8.B.7.0.5.6.7.8.C...1..i0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........V...,nyG..\|..c.X..g.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..q0H..+.....7...1:08...F.i.l.e.......&s.p.e.c.t.r.o.j.e.t._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9742
Entropy (8bit):	5.203938700783149
Encrypted:	false
SSDEEP:	192:B8HvMWGKLZlAdwo3UqTM1g4fRb7J2sIVkTBgdmXnG4jzeVtc2nVc:B8Htl2tNTMG4ft8TkV1nGkzA2
MD5:	7FBD82746CF38DA2A8728A7C47112124
SHA1:	56131AEB2C6E7947E1FB7CB282638B58B705678C
SHA-256:	EFAD8843EB281869659A13CE3FCC48D5922C85A5CF63F4E91A6C22B0B9683F2D
SHA-512:	DCE593288E62E60CBC6E2C3CB1EED01B56A3431F324D877D41D98F3F38D20B2276A117EB9106B690C03A5816285D6864A0DD0A99132E0781C007B8C66D72C3D6
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{9f354680-41e4-a947-8983-0a6ae0b9b27b}\spectrojet_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET553A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET556A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\SET559A.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	7.163912217919972
Encrypted:	false
SSDEEP:	192:hF2lRtPCj1nYe+PjP3rTqavM+vmr9ZCspE+TMAr+Nm0jPgH:T2gJnYPL3qaLeMnk5
MD5:	EC1239127DC978757B0B9CC27D35128E
SHA1:	DD4FE65A456D244DAA29E85FF5AF7E1B4BF64014
SHA-256:	FD4981D78D8F37AAA13BEDB75406B61FF24BE17589187AC1D8FE8E8DDF0B1863
SHA-512:	EC3C70835A009A719893B54B682BC3ED6085F506D29E1C93E255040B633ECED4DA7449C16B5F636119EB9F97314A8ADE347D9FC0B3C4ECD5A082FA771CCAA0C7
Malicious:	false
Preview:	0..h...H.........Y0..U...1.0...+......0.....+.....7......0...0...+.....7.....Y....+,J...U..X...140516140008Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RA.1.6.D.E.3.5.E.A.B.4.E.6.E.5.1.B.E.4.5.4.4.7.9.3.A.0.5.D.B.C.6.6.8.2.9.8.D.E.B...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.p.l.a.t.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........m.^.NnQ.EDy:...h)..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.200481985878872
Encrypted:	false
SSDEEP:	192:B8HvMWGzLZlAdwo3UqTMH4fRbz7sIVkTBgdVXnG4QzeVtc2UWv:B8H6l2tNTMH4ft/TkVmnGLzAJ
MD5:	120CBBA255C66FBCAAD7D49BCF567FA5
SHA1:	A16DE35EAB4E6E51BE4544793A05DBC668298DEB
SHA-256:	17E11451106D4DC767CE654D828EC5C3DE1AD9000BD51B7F5E2CA87334C71179
SHA-512:	73D7A772C5F9EBAB0D363DAF3BDCBB176B0EAE6A170258D9E1EE5D1AF7D7A194C1D1716364BE411EF5CFBD1DEB69A0ECAEFB9FC8CFF08ABD68DC13B630E533EE
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{c8a74b24-c087-b944-a9d3-d198b3071dfa}\spectroplate_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET863D.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET867C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\SET86AC.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	7.214945113432049
Encrypted:	false
SSDEEP:	192:3GmgPCj2yowJL/cu7RZgjlorfpx+viJdr9ZCspE+TMcrbdYr:39xSYJLca6jIp3weM+M
MD5:	F4F90EDFE025F3C918A7D4992F103A48
SHA1:	34A3A6E4711D1625CB29B5A800EF1D9569373A41
SHA-256:	51BE8127BE3D3F651D269A0885D66D16CA4030079CB8019754D7D5662090B203
SHA-512:	CD62D1FDE1741DE0F0EC81DB325A210305C72344FD9E111011C6264EAC5FF3E84C8E22CC779EFCB3449A4839164BE068D00D249C795B68D98E3702FEFBB5FD6A
Malicious:	false
Preview:	0.%d...H........%U0.%Q...1.0...+......0.....+.....7......0...0...+.....7.........A@>C.<.._B.7..111202130217Z0...+.....7.....0...0....R5.C.5.A.1.D.6.2.D.C.C.8.E.4.A.E.5.5.C.9.5.7.3.1.0.0.D.1.2.A.4.5.6.3.1.9.A.5.5.A...1..u0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...s.y.s...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........\Z.b...U.W1..Ec..Z0....RD.2.4.7.5.3.B.F.3.E.9.E.4.4.F.0.4.5.5.A.7.C.C.8.8.8.0.3.D.2.A.C.0.7.2.7.C.8.C.8...1..m0L..+.....7...1>0<...F.i.l.e.......s.p.e.c.t.r.o.d.r.i.v.e._.x.6.4...i.n.f...0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........GS.>.D.EZ\|....'..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9774
Entropy (8bit):	5.201512481427886
Encrypted:	false
SSDEEP:	192:B8HvMWG/LZlAdwo3UqTMK4fRbK6sIVkTBgdJXnG4EzeVtc28SJn:B8HGl2tNTMK4ftzTkVanG/zArZ
MD5:	9232DCCBA703DBE10F07D17480D831F9
SHA1:	D24753BF3E9E44F0455A7CC88803D2AC0727C8C8
SHA-256:	792CE4DA7EA6403A6D53A6F5C563F686CD72989E716CABFF6FAED59DE477F8C2
SHA-512:	03772B2742906A1AE260A30C97E52997A869B79C2D7A7491681F2E506757F8E057075CE4F1BB63761D6BA748AA6D28E0AA7B5930BDF3FC5B1A2637F88AD9BC33
Malicious:	false
Preview:	;..; * This file was generated by USBIO Installation Wizard. ..;..;..; USBIO Setup Information file V2.50..; Copyright (c) 1998-2009 by Thesycon GmbH..;..; This file supports:..; Windows XP x64 Edition..; Windows Vista x64..; Windows 7 x64..; Windows Server 2003 x64..; Windows Server 2008 x64..;..; To create a customized version of this file..; modify sections marked with ### modify here ###..; For details, refer to the USBIO Reference Manual...;..; Note:..; Some section names (enclosed in []) are system-defined and should not be changed...; Private section names start with an '_'. Those can be changed...;..; Refer to the Windows DDK documentation for more information on INF files...;....;*****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..DriverVer=11/16/2009,2.50.0.0....; Th

C:\Windows\System32\DriverStore\Temp\{ceebd2dd-ea39-9044-afd8-41621eb760d6}\spectrodrive_x64.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48488
Entropy (8bit):	6.440221003074469
Encrypted:	false
SSDEEP:	768:uK4Pgwcmf/CQeVMVV8xwaLlFHGLC/v2YjVt3M9/9ao6C3l2HOkGiFB+QL/MmwbCU:cTcmyVMVN5C/niEWkHO3iFB+QbDkCGJ
MD5:	8E049EC67A13CB855C0717D88CB75C25
SHA1:	F39038344DBEBD62719CEA89F1B5EA7D4489C5D1
SHA-256:	6E6FAE0D077BFD57AE363324EBE06FB318364A7E76339535F49B605559704BD6
SHA-512:	E9700A50C5D22AEBD8FDE98EDF92F034494403413CC2DD67400BDAA82CCA60911A1871B977B9A2406DB161D6129A3FA89EAF6DD9F88C9232DA327A8CF1D82AE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=_..=_..=_..<_..=_.2F_..=_.2@_..=_.2P_..=_.2O_..=_.2A_..=_.2E_..=_Rich..=_........................PE..d...I.J.........."......x..........................................................F}......................................................d...P.......................h'......4...0...................................................(............................text...om.......n.................. ..h.rdata..H............r..............@..H.data................~..............@....pdata..............................@..HINIT................................ ....rsrc...............................@..B.reloc..............................@..B................................................................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	6719
Entropy (8bit):	5.302103870369462
Encrypted:	false
SSDEEP:	192:UOYYKOYYKx00cQiev1liGdUiGdUdhNb6KWAbcXDX9hl6tbNuwQ:UfYKfYKx00cuTiGdUiGdUdhCP
MD5:	D20E560EF358E1CC075EA2D026313178
SHA1:	48A8E9D53D17C3D964870FBB099558CADFD48A8C
SHA-256:	C8D58EB36F799FC67EFD094E287462D41EB9C8C79EB166EBD90C2BF4C4CBB4E8
SHA-512:	C21341A725B4AFA37E186B848BADE79D1E73AA49E9C30A51C795E8F859A2AA5763FC6661BC65F8CD6008EFB041129C424184CB4EC77BC9822B29B3E455A90FC9
Malicious:	false
Preview:	CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: SyncAllDBs Corruption or Schema Change..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 12:38:54 AM 9/3/2021: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 12:38:54 AM 9/3/2021: SyncD

C:\Windows\Temp\~DF143D987FAD90CA33.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.351205858233362
Encrypted:	false
SSDEEP:	192:qt1Vb1BgkSnuYQ0jg5Bt+GS7DDsv4TKDZRD/IYI:OPxB+nuVCg5BtoDsrDZ1/
MD5:	791251FC20A7C8E1D34B9E7765D0BF0E
SHA1:	0DC8796973D6DEEFD5E9F95BDA507BEDE63FD3E3
SHA-256:	FE92625B61CF76728CC68268228102BAFC9DCDE5E685D6B177052E095255331A
SHA-512:	C2C93C9F80006920194A501DBB107B209CB64CA97D040BBB1C314D57BBB09123DE97B60106FA3B63D985FA3E4191F5AAB7FD6404FABB8143D546E485BB967016
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF37351A9BFCFDBB6F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF39C0D5594781EC40.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.5371067531425333
Encrypted:	false
SSDEEP:	24:/bF0mlGAu8HscELypUHOl050j9/ZVuNjJPUB//:/bamlwP6UW052y6//
MD5:	98DAD454EA741487DDEECF44A849F212
SHA1:	0A31507139CFE50B514891E8A6000C6F443ADCDC
SHA-256:	9DD769C5AE6AABA499786B8F5696CBDEE3BC8CF542F67F2559DDAC5987E38379
SHA-512:	DDFEAEA0844AADB5BA476DB4E3DCA46AE3D8326EF4C0300CD9C0CC1303C487863240C5BE6D4B9C0EC79B5F58127DB8A35473CFD4854DF3509D7123E366AB161E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF435D62A7EC9E650C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7878893430217928
Encrypted:	false
SSDEEP:	192:1Gx6r1BgkSnuYQ0jg5Bt+GS7DDsv4TKDZRD/IYI:1OSB+nuVCg5BtoDsrDZ1/
MD5:	CCABAEAAC2DB8D9CA7723928518B8897
SHA1:	BD2BB7883BABDC5BA6A64E3D4C74F11EA7944B31
SHA-256:	E2D7A614BDE4B44AA867F1F79384255BA106D61581E898FB1C84BAC660B73A94
SHA-512:	61A6011071EEB7703C6CE37716EA50CB52138FDE5F5C1E186475B9BF3D270DA6B71730780DA0D44BE5A7CDA9DCE66DCCEADEF423C7E159E31010FD82C7CFD265
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4751F1F7F52E880D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4FA896AF106E0890.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5B77730ED7B1808C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	0.8683449633455047
Encrypted:	false
SSDEEP:	192:s3OYXmcMAcAYAiAbAOAAsjqpSjwlJy/Aa8BAx3oFGg5Bt+vSB3DFgBYuEsDo1SAF:sPzZFXkzsQxYsg5BoiDFEDo1SA7/
MD5:	E21AF55FE1E5DC333750F4C57F07A7C3
SHA1:	CEBBA7B8475E749E3EEEBD6DE0EA75660D57648F
SHA-256:	8B53702EEAD86DAAD2DEC8DD6E26D8919D8B57EF14580D96F681BAE904F25500
SHA-512:	BBF50F2120367BEB6DC6C5AD641E7E9DFA1A88F906415A163D26A80E7DE63E4129B1C774C75F3231C2AC0C03A5DE47ACB422357A732A92E1ECDC5C94940B70F6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A8C9AB38817112B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4855112921180504
Encrypted:	false
SSDEEP:	48:C8PhbuRc06WXJGFT5vI4Xn3tZ/1Cfq6Oe0ZPfjOy:thb1dFTz33D/1CnfuPC
MD5:	92F06D61F100A3BD2B8C18EE665FF26E
SHA1:	DB96F68A66392E4227F4D3CC9539A1DAE43231F0
SHA-256:	4E582B7165F78BFE372470A0FF6640A9AB2F8840F1159D707CFCF5FA6D5324F2
SHA-512:	B8ED3D71DB489FA3540FDC0BF45A0AAB0DB9C4F408809FFABCABC0544502377ED0CC3DCEC1D0B5D093D0A2C450CA57E38A2245F0431801D68298B6C6F63FDAEC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6C5AEB38B70D984C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4855112921180504
Encrypted:	false
SSDEEP:	48:C8PhbuRc06WXJGFT5vI4Xn3tZ/1Cfq6Oe0ZPfjOy:thb1dFTz33D/1CnfuPC
MD5:	92F06D61F100A3BD2B8C18EE665FF26E
SHA1:	DB96F68A66392E4227F4D3CC9539A1DAE43231F0
SHA-256:	4E582B7165F78BFE372470A0FF6640A9AB2F8840F1159D707CFCF5FA6D5324F2
SHA-512:	B8ED3D71DB489FA3540FDC0BF45A0AAB0DB9C4F408809FFABCABC0544502377ED0CC3DCEC1D0B5D093D0A2C450CA57E38A2245F0431801D68298B6C6F63FDAEC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8387B517D75FCFCB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0093338792840023
Encrypted:	false
SSDEEP:	192:SavwCDFGg5Bt+vSB3DFgBYuEsDo1SAlmo/SY7nYXmcMAcAYAiAbAOAAsjqpSjwli:S8jDsg5BoiDFEDo1SA7/ezZFXkzsQx
MD5:	9B79BBED576E0CA61F8103964B67C231
SHA1:	EC8CA6A61F6CF7A31D53419FEAF63B19825D62A7
SHA-256:	038932197299181CAE2820A63629CAF56B8F4360308940E14982D8E2C1431370
SHA-512:	445B08B19A1B1514D8194E19766269FA954AB7577BF2A4B0F67DE86B3F607F7999AB5404D3DB251C57F4A9496F135A20A24B0388F84698DBBCE2C7A8F19892D2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF85593E5ED74D9F35.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0093338792840023
Encrypted:	false
SSDEEP:	192:SavwCDFGg5Bt+vSB3DFgBYuEsDo1SAlmo/SY7nYXmcMAcAYAiAbAOAAsjqpSjwli:S8jDsg5BoiDFEDo1SA7/ezZFXkzsQx
MD5:	9B79BBED576E0CA61F8103964B67C231
SHA1:	EC8CA6A61F6CF7A31D53419FEAF63B19825D62A7
SHA-256:	038932197299181CAE2820A63629CAF56B8F4360308940E14982D8E2C1431370
SHA-512:	445B08B19A1B1514D8194E19766269FA954AB7577BF2A4B0F67DE86B3F607F7999AB5404D3DB251C57F4A9496F135A20A24B0388F84698DBBCE2C7A8F19892D2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA1401048117B81B3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7878893430217928
Encrypted:	false
SSDEEP:	192:1Gx6r1BgkSnuYQ0jg5Bt+GS7DDsv4TKDZRD/IYI:1OSB+nuVCg5BtoDsrDZ1/
MD5:	CCABAEAAC2DB8D9CA7723928518B8897
SHA1:	BD2BB7883BABDC5BA6A64E3D4C74F11EA7944B31
SHA-256:	E2D7A614BDE4B44AA867F1F79384255BA106D61581E898FB1C84BAC660B73A94
SHA-512:	61A6011071EEB7703C6CE37716EA50CB52138FDE5F5C1E186475B9BF3D270DA6B71730780DA0D44BE5A7CDA9DCE66DCCEADEF423C7E159E31010FD82C7CFD265
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA8256DDED897E7BB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.7878893430217928
Encrypted:	false
SSDEEP:	192:1Gx6r1BgkSnuYQ0jg5Bt+GS7DDsv4TKDZRD/IYI:1OSB+nuVCg5BtoDsrDZ1/
MD5:	CCABAEAAC2DB8D9CA7723928518B8897
SHA1:	BD2BB7883BABDC5BA6A64E3D4C74F11EA7944B31
SHA-256:	E2D7A614BDE4B44AA867F1F79384255BA106D61581E898FB1C84BAC660B73A94
SHA-512:	61A6011071EEB7703C6CE37716EA50CB52138FDE5F5C1E186475B9BF3D270DA6B71730780DA0D44BE5A7CDA9DCE66DCCEADEF423C7E159E31010FD82C7CFD265
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB487DAF3621181B2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40513758244142983
Encrypted:	false
SSDEEP:	24:/jF0mljcsiQs5hBFyTUksTQ+F/ymZU+/w/FD+utO7K:/jamljcsmBITdsT2AK
MD5:	C9CE37571D2D99AF9CCD5C5BAE4EA9DA
SHA1:	412B6CEC7D93E35891DA132C8A0625B5943CC035
SHA-256:	0874EB1855AC1968237855FC450B59CEB1FC7AA39A6CA269744900577BB44228
SHA-512:	AB9DBFE452B9B69311C5AD9341A8FD0A4B75F7B6861841FD5082EEC6B5D45BB111A957AEF6FB0CEED141E3DE6986CFF5C18188B67E09E372186D5CADA967EAAE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB50D9C823CE87DC5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	2.0093338792840023
Encrypted:	false
SSDEEP:	192:SavwCDFGg5Bt+vSB3DFgBYuEsDo1SAlmo/SY7nYXmcMAcAYAiAbAOAAsjqpSjwli:S8jDsg5BoiDFEDo1SA7/ezZFXkzsQx
MD5:	9B79BBED576E0CA61F8103964B67C231
SHA1:	EC8CA6A61F6CF7A31D53419FEAF63B19825D62A7
SHA-256:	038932197299181CAE2820A63629CAF56B8F4360308940E14982D8E2C1431370
SHA-512:	445B08B19A1B1514D8194E19766269FA954AB7577BF2A4B0F67DE86B3F607F7999AB5404D3DB251C57F4A9496F135A20A24B0388F84698DBBCE2C7A8F19892D2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD19EF363FCB5C680.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD35679E223211F28.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD6A30B4EB60E0A69.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE217FB77D0624F8E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.739418406647458
Encrypted:	false
SSDEEP:	192:0WnuYT1Bgkg0jg5Bt+GS7DDsv4TKDZRD/IY:BnueBkCg5BtoDsrDZ1/
MD5:	7AD9E26ED22120E679B06302D31BE01E
SHA1:	6A2B1C4ECD486F5248027BE54F1326AF56D1E924
SHA-256:	F62E9BB4A50CC4B1AB68D40D590C12324817028ED28465BE2DE4E302B06C932D
SHA-512:	EEB20A9495DFADD52B3B9A740FF5C54E0DBB90DF940A60A8E44F63A8D66D498CD4FC5DC8A8E73558FA02916066A38AC427C862E07B10FF343214A5FC647208AF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE32DE13C24F3E317.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE718742CABAD2F9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE5168CA6534B9FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFAE8F0379744D34A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFBFFEF213ACF0F39.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.351205858233362
Encrypted:	false
SSDEEP:	192:qt1Vb1BgkSnuYQ0jg5Bt+GS7DDsv4TKDZRD/IYI:OPxB+nuVCg5BtoDsrDZ1/
MD5:	791251FC20A7C8E1D34B9E7765D0BF0E
SHA1:	0DC8796973D6DEEFD5E9F95BDA507BEDE63FD3E3
SHA-256:	FE92625B61CF76728CC68268228102BAFC9DCDE5E685D6B177052E095255331A
SHA-512:	C2C93C9F80006920194A501DBB107B209CB64CA97D040BBB1C314D57BBB09123DE97B60106FA3B63D985FA3E4191F5AAB7FD6404FABB8143D546E485BB967016
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992773034922727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8ue90oYkrv.exe
File size:	13'453'632 bytes
MD5:	5a0d2bc66c17c640e81233cf6a200e07
SHA1:	65ab84dc66feb7b7034ec5713b68fd39a6cd1a01
SHA256:	e6183c4c9f5224cf8923cb76170aaf489be9428c0b7ec56f0289a74b533e7457
SHA512:	702c862e10b31a7c14fa1c9d63d42b5710d5a7392b5acbb0ebb4605d8c92f77dd08b69234eea99a5fc7031fa337173e3c7f45547e0cc1e0e17465a6fbd110743
SSDEEP:	196608:uv/Ubmek67xSg9uXs1MAsG3UiKC0NWzqi3aumj37RtXuC9/RyXBNQeGvcGqR3q8H:g8aejfucanjC0NNtp37RdZeBNKvcGkfz
TLSH:	8DD63322F3EE8271FCB36EB859B18BAA462778119F35D6DF6348095D5E322C05A74313
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}'.O9F..9F..9F..0>[..F..0>J.-F..0>\.SF......;F......6F..9F...F..0>V.eF..'.K.8F..0>N.8F..Rich9F..................PE..L....Z.U...

File Icon


Icon Hash:	3e5bec56762e350b

Static PE Info

General

Entrypoint:	0x421bd6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x55EF5AD2 [Tue Sep 8 22:01:54 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	eaefd1169420dcee9fef7c65aa268740

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/03/2014 00:00:00 03/06/2017 00:59:59
Subject Chain	CN=TECHKON GmbH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TECHKON GmbH, L=Koenigstein, S=Hessen, C=DE
Version:	3
Thumbprint MD5:	7CA2896A0BED0C0EA2C32E34FA89EDB3
Thumbprint SHA-1:	B6E6CB217307F0D3CD5CA360D368887B8FA98BA3
Thumbprint SHA-256:	F712E6788F1A6B6C520E5203EE07C2421F8D157D0B041AC9AA8ECABADBEFB87A
Serial:	2C68B7C967BB304C0C911BB4D3311D95

Entrypoint Preview

Instruction
call 00007FC478933786h
jmp 00007FC47893011Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004393B8h], eax
mov dword ptr [004393B4h], ecx
mov dword ptr [004393B0h], edx
mov dword ptr [004393ACh], ebx
mov dword ptr [004393A8h], esi
mov dword ptr [004393A4h], edi
mov word ptr [004393D0h], ss
mov word ptr [004393C4h], cs
mov word ptr [004393A0h], ds
mov word ptr [0043939Ch], es
mov word ptr [00439398h], fs
mov word ptr [00439394h], gs
pushfd
pop dword ptr [004393C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004393BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004393C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004393CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00439308h], 00010001h
mov eax, dword ptr [004393C0h]
mov dword ptr [004392BCh], eax
mov dword ptr [004392B0h], C0000409h
mov dword ptr [004392B4h], 00000001h
mov eax, dword ptr [00437024h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00437028h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000098h]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x360e8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x1b0c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xcd3020	0x1920
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30e10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x264	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2cb9d	0x2cc00	08b1425d0c235f73ec2fd58abfe6486d	False	0.5150412447625698	data	6.487113973217182	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0x8e28	0x9000	2493c37a97f6e172b3dd001b1af0d594	False	0.3415256076388889	data	4.651109246510969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x8300	0x2400	5b956e9eb3e2cde75a854ea16ed7c543	False	0.2583550347222222	data	4.183030383074928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40000	0x1b0c8	0x1b200	0776982004dfe8682cdafdb0e01c538b	False	0.2710883496543779	data	4.541515290825601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x40d14	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.35261194029850745
RT_ICON	0x41bbc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.36236462093862815
RT_ICON	0x42464	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3302023121387283
RT_ICON	0x429cc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.27842323651452283
RT_ICON	0x44f74	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3557692307692308
RT_ICON	0x4601c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4512411347517731
RT_DIALOG	0x46484	0x1d8	data			0.5720338983050848
RT_DIALOG	0x4665c	0x1be	data			0.5605381165919282
RT_DIALOG	0x4681c	0x54	data			0.7619047619047619
RT_STRING	0x46870	0x478	Matlab v4 mat-file (little endian) D\006'\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.2972027972027972
RT_STRING	0x46ce8	0x5ba	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Catalan	Spain	0.252387448840382
RT_STRING	0x472a4	0x1ca	Matlab v4 mat-file (little endian) !q\325luR\372^\207e\366N>Y , numeric, rows 0, columns 0	Chinese	Taiwan	0.5131004366812227
RT_STRING	0x47470	0x4ea	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Czech	Czech Republic	0.2845786963434022
RT_STRING	0x4795c	0x4d6	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Danish	Denmark	0.2689822294022617
RT_STRING	0x47e34	0x6b6	Matlab v4 mat-file (little endian) O, numeric, rows 0, columns 0	German	Germany	0.2409778812572759
RT_STRING	0x484ec	0x596	Matlab v4 mat-file (little endian) \224\003\265\003\275\003 , numeric, rows 0, columns 0	Greek	Greece	0.2853146853146853
RT_STRING	0x48a84	0x48c	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	English	United States	0.27405498281786944
RT_STRING	0x48f10	0x57c	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	Finnish	Finland	0.24287749287749288
RT_STRING	0x4948c	0x63c	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	French	France	0.22807017543859648
RT_STRING	0x49ac8	0x370	Matlab v4 mat-file (little endian) ', numeric, rows 0, columns 0	Hebrew	Israel	0.33636363636363636
RT_STRING	0x49e38	0x4c6	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Hungarian	Hungary	0.29705400981996727
RT_STRING	0x4a300	0x528	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	Italian	Italy	0.25227272727272726
RT_STRING	0x4a828	0x2c6	Matlab v4 mat-file (little endian) \3250\2510\3530\3000 , numeric, rows 0, columns 0	Japanese	Japan	0.4295774647887324
RT_STRING	0x4aaf0	0x290	Matlab v4 mat-file (little endian) \364\323T\263\|\271 , numeric, rows 0, columns 0	Korean	North Korea	0.4634146341463415
RT_STRING	0x4aaf0	0x290	Matlab v4 mat-file (little endian) \364\323T\263\|\271 , numeric, rows 0, columns 0	Korean	South Korea	0.4634146341463415
RT_STRING	0x4ad80	0x5b2	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Dutch	Netherlands	0.2496570644718793
RT_STRING	0x4b334	0x496	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Norwegian	Norway	0.2632027257240204
RT_STRING	0x4b7cc	0x4bc	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Polish	Poland	0.2838283828382838
RT_STRING	0x4bc88	0x5a6	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Brazil	0.25311203319502074
RT_STRING	0x4c230	0x582	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Romanian	Romania	0.2581560283687943
RT_STRING	0x4c7b4	0x52c	data	Russian	Russia	0.2809667673716012
RT_STRING	0x4cce0	0x47a	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Croatian	Croatia	0.27486910994764396
RT_STRING	0x4d15c	0x506	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Slovak	Slovakia	0.2690513219284603
RT_STRING	0x4d664	0x4be	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Swedish	Sweden	0.25617792421746294
RT_STRING	0x4db24	0x458	Matlab v4 mat-file (little endian) D\016!\016H\016\0162\016!\0162\016#\016\026\016\016#\016I\0162\016\007\016B\016\037\016%\016@\016\024\016-\016#\016L\016D\016\024\016I\016 , numeric, rows 0, columns 0	Thai	Thailand	0.3255395683453237
RT_STRING	0x4df7c	0x3fc	Matlab v4 mat-file (little endian) ', numeric, rows 0, columns 0	Turkish	Turkey	0.31862745098039214
RT_STRING	0x4e378	0x5b6	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Slovenian	Slovenia	0.25239398084815323
RT_STRING	0x4e930	0x4ea	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	Estonian	Estonia	0.2599364069952305
RT_STRING	0x4ee1c	0x578	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Latvian	Lativa	0.25642857142857145
RT_STRING	0x4f394	0x4b8	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Lithuanian	Lithuania	0.2814569536423841
RT_STRING	0x4f84c	0x484	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Vietnamese	Vietnam	0.24567474048442905
RT_STRING	0x4fcd0	0x590	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Basque	France	0.25280898876404495
RT_STRING	0x4fcd0	0x590	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Basque	Spain	0.25280898876404495
RT_STRING	0x50260	0x1ca	Matlab v4 mat-file (little endian) \340e\325l\033R\372^\207e\366N9Y , numeric, rows 0, columns 0	Chinese	China	0.5131004366812227
RT_STRING	0x5042c	0x61c	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Portugal	0.2289002557544757
RT_STRING	0x50a48	0x5fc	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0			0.24216710182767623
RT_STRING	0x51044	0x27e	data	Arabic	Saudi Arabia	0.46551724137931033
RT_STRING	0x512c4	0x39e	data	Catalan	Spain	0.3941684665226782
RT_STRING	0x51664	0xea	data	Chinese	Taiwan	0.8333333333333334
RT_STRING	0x51750	0x302	data	Czech	Czech Republic	0.4701298701298701
RT_STRING	0x51a54	0x326	data	Danish	Denmark	0.413151364764268
RT_STRING	0x51d7c	0x442	data	German	Germany	0.38073394495412843
RT_STRING	0x521c0	0x376	data	Greek	Greece	0.43115124153498874
RT_STRING	0x52538	0x2f2	data	English	United States	0.42572944297082227
RT_STRING	0x5282c	0x31c	data	Finnish	Finland	0.4258793969849246
RT_STRING	0x52b48	0x3de	AmigaOS bitmap font "r", fc_YSize 29184, 17664 elements, 2nd "u", 3rd "'"	French	France	0.36666666666666664
RT_STRING	0x52f28	0x24c	data	Hebrew	Israel	0.4574829931972789
RT_STRING	0x53174	0x342	AmigaOS bitmap font "s", fc_YSize 24832, 18688 elements, 2nd "b", 3rd "n"	Hungarian	Hungary	0.42206235011990406
RT_STRING	0x534b8	0x3aa	data	Italian	Italy	0.3699360341151386
RT_STRING	0x53864	0x1cc	data	Japanese	Japan	0.6804347826086956
RT_STRING	0x53a30	0x1a4	data	Korean	North Korea	0.7452380952380953
RT_STRING	0x53a30	0x1a4	data	Korean	South Korea	0.7452380952380953
RT_STRING	0x53bd4	0x37c	AmigaOS bitmap font "n", fc_YSize 29184, 20224 elements, 2nd ".", 3rd "*"	Dutch	Netherlands	0.40358744394618834
RT_STRING	0x53f50	0x324	data	Norwegian	Norway	0.4166666666666667
RT_STRING	0x54274	0x372	data	Polish	Poland	0.42063492063492064
RT_STRING	0x545e8	0x38e	data	Portuguese	Brazil	0.38461538461538464
RT_STRING	0x54978	0x39e	data	Romanian	Romania	0.4136069114470842
RT_STRING	0x54d18	0x35a	data	Russian	Russia	0.42424242424242425
RT_STRING	0x55074	0x2de	data	Croatian	Croatia	0.4223433242506812
RT_STRING	0x55354	0x340	data	Slovak	Slovakia	0.4338942307692308
RT_STRING	0x55694	0x310	data	Swedish	Sweden	0.42346938775510207
RT_STRING	0x559a4	0x2be	data	Thai	Thailand	0.47293447293447294
RT_STRING	0x55c64	0x2a6	AmigaOS bitmap font "i", fc_YSize 30208, 16896 elements, 2nd "z", 3rd " "	Turkish	Turkey	0.46607669616519176
RT_STRING	0x55f0c	0x380	data	Slovenian	Slovenia	0.39285714285714285
RT_STRING	0x5628c	0x33a	data	Estonian	Estonia	0.4067796610169492
RT_STRING	0x565c8	0x374	data	Latvian	Lativa	0.4117647058823529
RT_STRING	0x5693c	0x31a	AmigaOS bitmap font "e", fc_YSize 25600, 19968 elements, 2nd "p", 3rd "o"	Lithuanian	Lithuania	0.43828715365239296
RT_STRING	0x56c58	0x2ba	data	Vietnamese	Vietnam	0.39111747851002865
RT_STRING	0x56f14	0x36a	data	Basque	France	0.41533180778032036
RT_STRING	0x56f14	0x36a	data	Basque	Spain	0.41533180778032036
RT_STRING	0x57280	0xe8	data	Chinese	China	0.8362068965517241
RT_STRING	0x57368	0x3d2	data	Portuguese	Portugal	0.3834355828220859
RT_STRING	0x5773c	0x3ae	data			0.37579617834394907
RT_STRING	0x57aec	0xee	data	Arabic	Saudi Arabia	0.592436974789916
RT_STRING	0x57bdc	0x12c	data	Catalan	Spain	0.5133333333333333
RT_STRING	0x57d08	0x92	data	Chinese	Taiwan	0.678082191780822
RT_STRING	0x57d9c	0xf8	data	Czech	Czech Republic	0.5604838709677419
RT_STRING	0x57e94	0xf4	data	Danish	Denmark	0.5450819672131147
RT_STRING	0x57f88	0x10e	data	German	Germany	0.5
RT_STRING	0x58098	0x10c	data	Greek	Greece	0.5970149253731343
RT_STRING	0x581a4	0x106	data	English	United States	0.5076335877862596
RT_STRING	0x582ac	0xe4	data	Finnish	Finland	0.5175438596491229
RT_STRING	0x58390	0x144	data	French	France	0.48148148148148145
RT_STRING	0x584d4	0xd4	data	Hebrew	Israel	0.6084905660377359
RT_STRING	0x585a8	0xfe	data	Hungarian	Hungary	0.531496062992126
RT_STRING	0x586a8	0x122	data	Italian	Italy	0.503448275862069
RT_STRING	0x587cc	0xa6	data	Japanese	Japan	0.6807228915662651
RT_STRING	0x58874	0xaa	data	Korean	North Korea	0.7352941176470589
RT_STRING	0x58874	0xaa	data	Korean	South Korea	0.7352941176470589
RT_STRING	0x58920	0xf4	data	Dutch	Netherlands	0.5122950819672131
RT_STRING	0x58a14	0x106	data	Norwegian	Norway	0.5114503816793893
RT_STRING	0x58b1c	0xea	data	Polish	Poland	0.5341880341880342
RT_STRING	0x58c08	0x10a	data	Portuguese	Brazil	0.49624060150375937
RT_STRING	0x58d14	0x12c	data	Romanian	Romania	0.49
RT_STRING	0x58e40	0x114	data	Russian	Russia	0.5398550724637681
RT_STRING	0x58f54	0xf2	data	Croatian	Croatia	0.5743801652892562
RT_STRING	0x59048	0xf8	data	Slovak	Slovakia	0.5483870967741935
RT_STRING	0x59140	0x134	data	Swedish	Sweden	0.4318181818181818
RT_STRING	0x59274	0x118	data	Thai	Thailand	0.5285714285714286
RT_STRING	0x5938c	0xf2	data	Turkish	Turkey	0.5619834710743802
RT_STRING	0x59480	0x11e	data	Slovenian	Slovenia	0.5104895104895105
RT_STRING	0x595a0	0xee	data	Estonian	Estonia	0.542016806722689
RT_STRING	0x59690	0x110	data	Latvian	Lativa	0.5257352941176471
RT_STRING	0x597a0	0xec	data	Lithuanian	Lithuania	0.5720338983050848
RT_STRING	0x5988c	0x10a	data	Vietnamese	Vietnam	0.5037593984962406
RT_STRING	0x59998	0x138	data	Basque	France	0.46794871794871795
RT_STRING	0x59998	0x138	data	Basque	Spain	0.46794871794871795
RT_STRING	0x59ad0	0x92	data	Chinese	China	0.6575342465753424
RT_STRING	0x59b64	0x122	data	Portuguese	Portugal	0.49310344827586206
RT_STRING	0x59c88	0x132	data			0.48366013071895425
RT_GROUP_ICON	0x59dbc	0x5a	data	English	United States	0.7
RT_VERSION	0x59e18	0xe40	data	English	United States	0.11677631578947369
RT_MANIFEST	0x5ac58	0x470	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4507042253521127

Imports

DLL	Import
KERNEL32.dll	GetLastError, ResetEvent, CreateEventW, CloseHandle, MultiByteToWideChar, WideCharToMultiByte, GetModuleFileNameW, FormatMessageW, LocalFree, GetWindowsDirectoryW, CreateFileW, SetFileTime, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryW, DeleteFileW, GetShortPathNameW, GetFullPathNameW, lstrlenW, GetCurrentDirectoryW, GetTempFileNameW, FindClose, FindFirstFileW, FindNextFileW, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, DeleteCriticalSection, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, Sleep, LocalAlloc, SetCurrentDirectoryW, GetVersion, GetCommandLineW, CreateProcessW, GetExitCodeProcess, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetLocaleInfoA, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, LoadLibraryA, RaiseException, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, WaitForSingleObject, SetEvent, GetVersionExW, VirtualAlloc, WaitForMultipleObjects, VirtualFree, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, HeapSize, InterlockedDecrement, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, HeapFree, HeapAlloc, ExitThread, CreateThread, HeapReAlloc, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetModuleHandleW, GetProcAddress, ExitProcess, GetModuleFileNameA, TlsGetValue, TlsAlloc
USER32.dll	SetForegroundWindow, CharUpperW, DestroyWindow, RegisterWindowMessageW, AdjustWindowRect, LoadImageW, KillTimer, SetTimer, PostMessageW, EndDialog, IsDlgButtonChecked, SetDlgItemTextW, GetDlgItem, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, LoadStringW, DialogBoxParamW, CreateDialogParamW, SystemParametersInfoW, PeekMessageW, GetDesktopWindow, MessageBoxW, SendMessageW, GetWindowLongW, SetWindowLongW, ShowWindow, MoveWindow, GetWindowRect, LoadIconW
GDI32.dll	GetObjectW
ADVAPI32.dll	RegSetValueExW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	ShellExecuteExW, SHGetFolderPathW
ole32.dll	CoInitialize, CoCreateInstance
OLEAUT32.dll	SysAllocStringLen, SysFreeString, VariantClear, SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Catalan	Spain
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Romanian	Romania
Russian	Russia
Croatian	Croatia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Slovenian	Slovenia
Estonian	Estonia
Latvian	Lativa
Lithuanian	Lithuania
Vietnamese	Vietnam
Chinese	China
Portuguese	Portugal

Target ID:	0
Start time:	12:29:27
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Imagebase:	0x7ff711700000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:29:27
Start date:	14/03/2024
Path:	C:\Users\user\Desktop\8ue90oYkrv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\8ue90oYkrv.exe
Imagebase:	0x400000
File size:	13'453'632 bytes
MD5 hash:	5A0D2BC66C17C640E81233CF6A200E07
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:29:30
Start date:	14/03/2024
Path:	C:\ProgramData\miaE9AF.tmp\TDService.exe
Wow64 process (32bit):	true
Commandline:	.\TDService.exe /m="C:\Users\user\Desktop\8UE90O~1.EXE" /k=""
Imagebase:	0x400000
File size:	5'295'078 bytes
MD5 hash:	A94A3D60FA8A54AB71ABED39D5883D86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000000.167625105498.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaE9AF.tmp\TDService.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:29:32
Start date:	14/03/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6815d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:29:33
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding FC59D1BB68DDFDC1E5D4349A53CC36CC
Imagebase:	0xf70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:29:34
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\USBIOCOM.dll
Imagebase:	0xf70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:29:34
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\TDSCON.ocx
Imagebase:	0xf70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:29:34
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\MSWINSCK.OCX
Imagebase:	0xf70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:29:34
Start date:	14/03/2024
Path:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe"
Imagebase:	0x9d0000
File size:	1'150'976 bytes
MD5 hash:	F00223A56D3F89627CC88625DBCB0C42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 2%, ReversingLabs Detection: 6%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:29:36
Start date:	14/03/2024
Path:	C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe" /s
Imagebase:	0x400000
File size:	2'902'256 bytes
MD5 hash:	F6CD94DEAEA55BB414650D6A9CB7DD6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:29:38
Start date:	14/03/2024
Path:	C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe
Wow64 process (32bit):	true
Commandline:	.\TechkonDriver64Bit.exe /s /m="C:\PROGRA~2\TECHKO~1\TECHKO~1\Driver\TECHKO~2.EXE" /k=""
Imagebase:	0x400000
File size:	5'299'123 bytes
MD5 hash:	5A3DA2206BD35C381B826FF748093684
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\miaB21.tmp\TechkonDriver64Bit.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:29:39
Start date:	14/03/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 60A2701AE26538E52DD17AD6BC358181
Imagebase:	0xf70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:29:41
Start date:	14/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\TECHKON GmbH\TECHKON Driver 64Bit\Cert\Cert.Bat" "
Imagebase:	0x7ff657960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:29:41
Start date:	14/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6687b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:29:41
Start date:	14/03/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -f -addstore TrustedPublisher TK1.cer
Imagebase:	0x7ff6ba8d0000
File size:	1'651'200 bytes
MD5 hash:	BD8D9943A9B1DEF98EB83E0FA48796C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:29:42
Start date:	14/03/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -f -addstore TrustedPublisher TK2.cer
Imagebase:	0x7ff6687b0000
File size:	1'651'200 bytes
MD5 hash:	BD8D9943A9B1DEF98EB83E0FA48796C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:29:42
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\DENS /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:29:43
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff711700000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:29:43
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{16e7fd5a-7fa1-284a-a78e-4c7e00d15a9e}\dens_x64.inf" "9" "439f12f93" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "c:\progra~1\techko~1\techko~1\dens"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:29:48
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\MF-IR /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:29:49
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a68cce64-7ff6-cf40-9135-83c2fc219f99}\spectrodens_ir_x64.inf" "9" "4b61cb89f" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\mf-ir"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:29:53
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SP6D70~1 /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:29:54
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{da57fd97-fa69-9340-a4da-037be2662fe1}\spectroplate_x64.inf" "9" "4010f9813" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\sp6d70~1"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:29:59
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~4 /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:30:00
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{9697d70c-ee9a-f048-8996-c17faa7f2c84}\spectrojet_x64.inf" "9" "4b5792527" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~4"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:30:06
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~3 /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:30:07
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{2b7966a8-8a6d-a94f-a256-589fc26d83d0}\spectrodrive_x64.inf" "9" "40b9ce367" "000000000000012C" "WinSta0\Default" "0000000000000110" "208" "c:\progra~1\techko~1\techko~1\spectr~3"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:30:12
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~2 /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:30:14
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{295155e4-5a7e-c344-9bda-c97bbccbaffe}\spectrodrive_x64.inf" "9" "48bc6c0e7" "0000000000000110" "WinSta0\Default" "0000000000000178" "208" "c:\progra~1\techko~1\techko~1\spectr~2"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:30:19
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	true
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPECTR~1 /D /SA /LM /F
Imagebase:	0x6c0000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:30:21
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{fa2b8a9a-24a0-6c46-aecd-31efdad63fbc}\spectrodens_x64.inf" "9" "46d73562f" "0000000000000178" "WinSta0\Default" "0000000000000190" "208" "c:\progra~1\techko~1\techko~1\spectr~1"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:30:27
Start date:	14/03/2024
Path:	C:\ProgramData\{CDCC27FF-B8C2-4EF0-92DE-CCCEB844BC67}\OFFLINE\mDIFxIDE.dll\x64DPInst.exe
Wow64 process (32bit):	false
Commandline:	C:\PROGRA~3\{CDCC2~1\OFFLINE\mDIFxIDE.dll\x64DPInst.exe /SW /SE /EL /PATH C:\PROGRA~1\\TECHKO~1\TECHKO~1\SPC171~1 /D /SA /LM /F
Imagebase:	0x7ff666970000
File size:	1'050'104 bytes
MD5 hash:	BE3C79033FA8302002D9D3A6752F2263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:30:28
Start date:	14/03/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{a2a72662-6183-c742-a103-e60145f480e5}\spectrojet_x64.inf" "9" "4c691d78b" "0000000000000190" "WinSta0\Default" "000000000000012C" "208" "c:\progra~1\techko~1\techko~1\spc171~1"
Imagebase:	0x7ff6b80b0000
File size:	344'576 bytes
MD5 hash:	D26EB7BD11479C9C3C5CB5641C4360E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:35:18
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Imagebase:	0x7ff711700000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	12:35:18
Start date:	14/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Imagebase:	0x7ff711700000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	118

Executed Functions

Function 0041F2D0 Relevance: 78.7, APIs: 20, Strings: 24, Instructions: 1660
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041E5C0: GetVersionExW.KERNEL32 ref: 0041E5E0

MessageBoxW.USER32(00000000,02306160,?,00012010), ref: 0041F322

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

CoInitialize.OLE32(00000000), ref: 0041F350
GetVersionExW.KERNEL32 ref: 0041F389
GetCommandLineW.KERNEL32(00000004,00000004,00000004,00000004), ref: 0041F436

Strings

-k=, xrefs: 0041F654
<, xrefs: 004202CE
ExecuteParameters, xrefs: 0041FD3D
"/k=, xrefs: 0041F63B
" /k=", xrefs: 0042075E
ExecuteFile, xrefs: 0041FCF6
RunProgram, xrefs: 0041FCAF
/k=, xrefs: 0041F666
, xrefs: 0041F69A
, xrefs: 00420358
", xrefs: 0041F68B
mia.lib, xrefs: 00420677
%%T, xrefs: 004205E2
@KA, xrefs: 0041FF38
D, xrefs: 0042072D
Directory, xrefs: 0041FB7A
%%T\, xrefs: 0042061B
/m=", xrefs: 00420775
"-k=, xrefs: 0041F620
setup.exe, xrefs: 00420487
Title, xrefs: 0041FAD0
PTn, xrefs: 0041F369
BeginPrompt, xrefs: 0041FAFF
Progress, xrefs: 0041FB2E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Version$CommandErrorFreeHeapInitializeLastLineMessage
String ID: $ $ /m="$"$" /k="$"-k=$"/k=$%%T$%%T\$-k=$/k=$<$@KA$BeginPrompt$D$Directory$ExecuteFile$ExecuteParameters$PTn$Progress$RunProgram$Title$mia.lib$setup.exe
API String ID: 2504683216-784449763
Opcode ID: 8e4316e5e1cb91bd92f44a1657cf3a3e21e2f08c1d298bee1368258b13409358
Instruction ID: 8ae80e7e1ea0a5da9484d0cc992cac7dbaeb8ea33a9bedbd46246e47c3c2bf24
Opcode Fuzzy Hash: 8e4316e5e1cb91bd92f44a1657cf3a3e21e2f08c1d298bee1368258b13409358
Instruction Fuzzy Hash: 09D2E6B06143409BD220EB75E842B9FB3E5AFC4308F40892EF58957252DB78F559CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0 Relevance: 4.6, APIs: 3, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(?,35A089A6,?,?), ref: 00407B10
FindFirstFileW.KERNELBASE(?,?,35A089A6,?,?), ref: 00407B2A
FindFirstFileW.KERNELBASE(?,?), ref: 00407B7E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: e3b150c79052ad27782232c84f3a52fc6a62a57a2177f983f14b6e4624e5d615
Instruction ID: 560bba3c12bb28fd588b29f65aec3029f033ad3fe931a3478cb76b2749ea814c
Opcode Fuzzy Hash: e3b150c79052ad27782232c84f3a52fc6a62a57a2177f983f14b6e4624e5d615
Instruction Fuzzy Hash: E5318F7190C3029FC720DF34D845B5BB7E4EB44724F100B2AE4A5933D1DB38A906CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A0 Relevance: 3.0, APIs: 2, Instructions: 45comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0041E6A3
CoCreateInstance.OLE32 ref: 0041E6CA

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 2cdb6139d6d9018f19570d7e36b6b22097f60c5826a9e3d961c17cac6fa76371
Instruction ID: 51c3d68f6bde5c068a399ea07d0c0e700ec6cb6b10fcc9f3be2698376900635b
Opcode Fuzzy Hash: 2cdb6139d6d9018f19570d7e36b6b22097f60c5826a9e3d961c17cac6fa76371
Instruction Fuzzy Hash: DC010C74344201AFD310DB96D885F5B77F9AF88B44F50882DF858C72A0E7B8E8498B56

Uniqueness

Uniqueness Score: -1.00%

Function 00419AA0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

Unknown error, xrefs: 0041A003

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CharUpper
String ID: Unknown error
API String ID: 9403516-83687255
Opcode ID: 2761547e7a1914e5cfac364daaa5c13b498969adc31383defdc27037288d2e85
Instruction ID: c92c129fdc3c76a0617035b0c9c6b73ca8392c23127d0512a78de34984e17ce4
Opcode Fuzzy Hash: 2761547e7a1914e5cfac364daaa5c13b498969adc31383defdc27037288d2e85
Instruction Fuzzy Hash: E92268752083808FC324DF69D884A5BBBE5BFC9304F54891EF29987351CB79E885CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEE0 Relevance: .7, Instructions: 722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37256b94bb60d5af6bc0b7cc110bb3124668dd40debc1630c3715b466050bab0
Instruction ID: a73d485eed2c0f547a0b7567924c6c7deb504bae5797be35f8c618b3fbe3f811
Opcode Fuzzy Hash: 37256b94bb60d5af6bc0b7cc110bb3124668dd40debc1630c3715b466050bab0
Instruction Fuzzy Hash: 49625E71600248DFCB10DF68C880A9EBBF5EF89304F24859EE849AB391C779ED45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041B730 Relevance: 22.7, APIs: 15, Instructions: 227
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041B774
LoadIconW.USER32(00400000,?), ref: 0041B796
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B7A8
SetTimer.USER32(?,00000003,00000064,00000000), ref: 0041B7B7
SetWindowTextW.USER32(?,?), ref: 0041B7C8
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041B7DE
SetDlgItemTextW.USER32(?,000003E7,?), ref: 0041B83D
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B898
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B8AD
SetEvent.KERNEL32 ref: 0041B8BB
GetLastError.KERNEL32 ref: 0041B8C5
GetWindowRect.USER32(?,?), ref: 0041B8F4
GetWindowRect.USER32(?,?), ref: 0041B911
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041B946
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041B9B8

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ErrorEventIconInfoLastLoadMoveParametersPostSystemTimer
String ID:
API String ID: 4208242464-0
Opcode ID: 8212f1b92ac8d9662513c723b768a45af60c9ba66733e5d3f47eddca9276ea67
Instruction ID: 6367b0c4eee05ecfc1dfa8353564df2870d360439f43c4ec88678ed8d53926e9
Opcode Fuzzy Hash: 8212f1b92ac8d9662513c723b768a45af60c9ba66733e5d3f47eddca9276ea67
Instruction Fuzzy Hash: 219145B1608344AFD310DF69C884A5BBBE9EB88704F404A2EF999D7391D774D940CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041D4D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_00006160,?), ref: 0041D4F4
ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D535
DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_00006160,?), ref: 0041D57B
WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D590
SetWindowTextW.USER32(?,?), ref: 0041D5A7
ShowWindow.USER32(?,00000001), ref: 0041D5C0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D5CB

Strings

setup.bmp, xrefs: 0041D50A

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$DialogObjectParamShowSingleWait$CreateText
String ID: setup.bmp
API String ID: 2497262453-2262724209
Opcode ID: 72b3b40019be3ca3750d4009480d7b4b18c2004af0f88731a6715918442dda41
Instruction ID: 1d5dabd48a9213cc4ee5c15c04374f547c5cd17aedaa24753aeb20be2184952a
Opcode Fuzzy Hash: 72b3b40019be3ca3750d4009480d7b4b18c2004af0f88731a6715918442dda41
Instruction Fuzzy Hash: 2A31F175740305ABC720DF25DC41FDB37A8EB48314F500629FA556B281CA34F806CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDD0 Relevance: 12.1, APIs: 8, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00008010), ref: 0041BDE8
GetObjectW.GDI32(00000000,00000018,?), ref: 0041BE15
SendMessageW.USER32(?,00000172,00000000,?), ref: 0041BE2A
MoveWindow.USER32(?,00000000,00000000,?,?,00000001), ref: 0041BE4A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041BE67
GetWindowLongW.USER32(?,000000F0), ref: 0041BECD
AdjustWindowRect.USER32(?,00000000), ref: 0041BED9
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0041BEFD

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$Move$AdjustErrorFreeHeapImageInfoLastLoadLongMessageObjectParametersRectSendSystem
String ID:
API String ID: 1590663869-0
Opcode ID: 9d7f9e0890f737e2ba4dd122624acd51a10f9590b6e1cac4c65fd5ed4c9739be
Instruction ID: 03af98d0d0ffadcbe7ba7a864b7898debb76d72cbabd0c032310ea64956284ab
Opcode Fuzzy Hash: 9d7f9e0890f737e2ba4dd122624acd51a10f9590b6e1cac4c65fd5ed4c9739be
Instruction Fuzzy Hash: 8941F8B1604300AFD354CF39DC85F6BBBE9EBC8710F444A2DF98AC6290D671E9458B66

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB70 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408050: CloseHandle.KERNEL32(?,35A089A6,00000000,?,80000000,00000001,00000000), ref: 0040807D
Part of subcall function 00408050: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,35A089A6,00000000,?,80000000,00000001,00000000), ref: 004080B0
Part of subcall function 00408050: CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040810E

CloseHandle.KERNEL32(?,?,00001000,?,80000000,00000001,35A089A6,?,?,?,00000004,00000000,0042D21B,000000FF,0041F8EB,?), ref: 0041EBF9

Strings

;!@InstallEnd@!, xrefs: 0041EC22, 0041ECAF
;!@Install@!UTF-8!, xrefs: 0041EC0A, 0041ED33

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 3498533004-372238525
Opcode ID: afc51a853e801afb9757ed0c4be47186c9cb9a67f59d5721a3fd60e810a4cbc9
Instruction ID: 951928544ea1403c87551abc08aa41bf64b6ac2c57d2d5833b4dbc2ae828a00e
Opcode Fuzzy Hash: afc51a853e801afb9757ed0c4be47186c9cb9a67f59d5721a3fd60e810a4cbc9
Instruction Fuzzy Hash: AD8109795083818BD330CF26D8847EBBBE1AB55314F540A5EE9D587381D739D8C6CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0041EAA3
RegCreateKeyExW.KERNELBASE ref: 0041EB1F
RegSetValueExW.KERNELBASE(00000000,IsHostApp,00000000,00000001,00000000,00000002), ref: 0041EB3F
RegCloseKey.ADVAPI32 ref: 0041EB49

Strings

IsHostApp, xrefs: 0041EB34
Applications\, xrefs: 0041EAC0

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseCreateFileModuleNameValue
String ID: Applications\$IsHostApp
API String ID: 506456306-1667566961
Opcode ID: 5cec257a012e9a1e1d57e1157371452729b30d6bfd67cdf483cdb0fb9429fb01
Instruction ID: 4aa4451f33cd243bcb97ec5c147c50c0ddf720af96767f8ac43c9fc97424fe1f
Opcode Fuzzy Hash: 5cec257a012e9a1e1d57e1157371452729b30d6bfd67cdf483cdb0fb9429fb01
Instruction Fuzzy Hash: 7121A7B17943007BE224EB61DC4BFAB73E4AF98B04F40491DB385961C1DAB4A544C79B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A930 Relevance: 9.1, APIs: 6, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A973
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A979
CloseHandle.KERNEL32(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A991
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A997
CloseHandle.KERNEL32(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B1
GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B7

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseErrorLast$Handle$ChangeFindNotification
String ID:
API String ID: 499975219-0
Opcode ID: 5ca849f9e80f7cf6a4f2ccd92f1cca5e306e245aee22a54abe53d0d2476e70a3
Instruction ID: b8afac3a52eb0e78b9d4f59a748d0347e24904ef526753f53a3bde94e43bcd0c
Opcode Fuzzy Hash: 5ca849f9e80f7cf6a4f2ccd92f1cca5e306e245aee22a54abe53d0d2476e70a3
Instruction Fuzzy Hash: 3D1181F23087418BD320DF29D800B27B7D8EB90B60F110D3EE89593780D73AE414CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBC0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DF0D

Part of subcall function 0041D4D0: CreateDialogParamW.USER32(00400000,000001F6,00000000,Function_00006160,?), ref: 0041D4F4
Part of subcall function 0041D4D0: ShowWindow.USER32(?,00000001,?,setup.bmp), ref: 0041D535
Part of subcall function 0041D4D0: DialogBoxParamW.USER32(00400000,000001F4,00000000,Function_00006160,?), ref: 0041D57B
Part of subcall function 0041D4D0: WaitForSingleObject.KERNEL32(?,000000FF,?,setup.bmp), ref: 0041D590
Part of subcall function 0041D4D0: SetWindowTextW.USER32(?,?), ref: 0041D5A7
Part of subcall function 0041D4D0: ShowWindow.USER32(?,00000001), ref: 0041D5C0
Part of subcall function 0041D4D0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D5CB

FindCloseChangeNotification.KERNELBASE(00000000,?,00000004,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DFAA
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0041DFB4

Strings

etup.bmp, xrefs: 0041DE32

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLastWindow$DialogHeapObjectParamShowSingleWait$AllocateChangeCloseCreateExceptionFindFreeNotificationRaiseText
String ID: etup.bmp
API String ID: 50554229-3436927654
Opcode ID: 51248fe61525d921019bc7784e8c2f4ce7418bc3d4169d9d94d46c807291a52d
Instruction ID: 14b6864db79aa0758f53e4780a0cfdcd85dd8687eaec00fb5cd2c2bcdf21938c
Opcode Fuzzy Hash: 51248fe61525d921019bc7784e8c2f4ce7418bc3d4169d9d94d46c807291a52d
Instruction Fuzzy Hash: 95D17FB55083808FD320EF65C880B9BB7E5AF98304F14892EF59987351D778E94ACB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE70 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00407D60: FindNextFileW.KERNELBASE(35A089A6,?,?,00000000), ref: 00407D8D

FindClose.KERNELBASE(?,?,mia.lib), ref: 0041F146

Strings

mia.lib, xrefs: 0041EE84

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$CloseErrorFileFreeHeapLastNext
String ID: mia.lib
API String ID: 2022707556-3926378727
Opcode ID: 106c9770c868863ecd1b176a45e11baaaa2e39fe68dba10e270c5d4592b9eba8
Instruction ID: acefb76dbfd321258123378c1413fdf74a6f6d2c8bb5f67a3714b289b7daedea
Opcode Fuzzy Hash: 106c9770c868863ecd1b176a45e11baaaa2e39fe68dba10e270c5d4592b9eba8
Instruction Fuzzy Hash: A1B18F755083809FC330DB29C44079BB7E1AF85318F444A2EF9D957391D739A98AC79B

Uniqueness

Uniqueness Score: -1.00%

Function 0041CCA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 0041CDBF
FindCloseChangeNotification.KERNELBASE(?), ref: 0041CDD4
GetLastError.KERNEL32 ref: 0041CDE6

Strings

PTn, xrefs: 0041CD4B, 0041CD7F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ChangeCloseErrorFileFindLastNotificationTime
String ID: PTn
API String ID: 3673273941-3877643181
Opcode ID: c825ca507cc76167d5b05d5c4b29e77f4d476bc3e0454580608a0aaad5d88e34
Instruction ID: 7b2998dd1cb06f6e771dfa2e92566308564360dd9503c26fc9d92f09fd085f74
Opcode Fuzzy Hash: c825ca507cc76167d5b05d5c4b29e77f4d476bc3e0454580608a0aaad5d88e34
Instruction Fuzzy Hash: 50417E756447418BE330CB79DC84BD3BBE5AB88314F184A2ED19A8B390C779E886C759

Uniqueness

Uniqueness Score: -1.00%

Function 00406690 Relevance: 6.1, APIs: 4, Instructions: 83
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,35A089A6,00000004,?,?,?), ref: 004066D2
CreateFileW.KERNEL32(35A089A6,40000000,00000003,00000000,00000003,02000000,00000000,?,00000000,00000004), ref: 0040672A
SetFileTime.KERNELBASE(00000000,00000000,00000000,?,?,40000000,00000003,00000000,00000003,02000000,00000000,35A089A6,00000004,?,?,?), ref: 00406750
FindCloseChangeNotification.KERNELBASE(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,35A089A6,00000004,?,?,?), ref: 0040675C

Part of subcall function 00407E60: GetCurrentDirectoryW.KERNEL32(00000105,35A089A6), ref: 00407F53

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: File$Create$ChangeCloseCurrentDirectoryFindNotificationTime
String ID:
API String ID: 4004719644-0
Opcode ID: 4019fdf441a4c4eb5f69e1d984c632c07fca8aefb080f6855eb8301330c79c31
Instruction ID: ac6c79c5a0dc6e211d532a3be32971133362d4db447b27be0444ece16f4d2a22
Opcode Fuzzy Hash: 4019fdf441a4c4eb5f69e1d984c632c07fca8aefb080f6855eb8301330c79c31
Instruction Fuzzy Hash: E02125712443207BE2209F25DC45F5B7BDCEB85B64F50062AF654A72C1C778A905CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 0041D750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,35A089A6,?,?,?,?,0042C782,000000FF), ref: 0041D7A6
DestroyWindow.USER32(?,35A089A6,?,?,?,?,0042C782,000000FF), ref: 0041D7C3

Strings

A, xrefs: 0041D786

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CallbackDestroyDispatcherUserWindow
String ID: A
API String ID: 2944404800-2078354741
Opcode ID: 5586f43cb49ad24856759286fed33058e7b89fb5ff18b7701b6384f671d7b546
Instruction ID: 7c98b1cd013b058fd397e9c972b29c14f6c4b2c3c95b67cdc02f0fa2510ff33a
Opcode Fuzzy Hash: 5586f43cb49ad24856759286fed33058e7b89fb5ff18b7701b6384f671d7b546
Instruction Fuzzy Hash: 3931E2B1A04B408BC720DF79C848B87B7E8AF48314F04490EF59987392D779F844CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408050 Relevance: 4.6, APIs: 3, Instructions: 88
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,35A089A6,00000000,?,80000000,00000001,00000000), ref: 0040807D
CreateFileW.KERNELBASE(?,?,?,00000000,00000003,00000080,00000000,35A089A6,00000000,?,80000000,00000001,00000000), ref: 004080B0
CreateFileW.KERNEL32(?,?,?,00000000,00000003,00000080,00000000), ref: 0040810E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 4b125d2712671a8b9b856184b240ac5c30ea288019e4421a8eb221e93ca9e89b
Instruction ID: eaacea67b0cf3e73bad7505eea8c61148c2237cac8ae426234bba4b99fc82f96
Opcode Fuzzy Hash: 4b125d2712671a8b9b856184b240ac5c30ea288019e4421a8eb221e93ca9e89b
Instruction Fuzzy Hash: 44316E716083119BD210DF24CC45B5BBBE8EB84774F104B2DF5A4A72D0D734A905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041C100 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,35A089A6,?,?,?,?,?,0042BEA8,000000FF,0041C57E,?,?), ref: 0041C12C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042BEA8,000000FF,0041C57E,?,?), ref: 0041C1A7

Strings

PTn, xrefs: 0041C140, 0041C171

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: PTn
API String ID: 3168844106-3877643181
Opcode ID: 9cbe4fff46b69963bc134ad39493b898461fb08ad28b906b1cb4e27107f027dc
Instruction ID: 256898e5de4089b529f01b85fbd61eb56f82475c3371ccf47f2285002a5edf27
Opcode Fuzzy Hash: 9cbe4fff46b69963bc134ad39493b898461fb08ad28b906b1cb4e27107f027dc
Instruction Fuzzy Hash: 582125B6204B009FC364DF19DA80A6BB3F9FB8C710B514A1EF55A93B10C734B805CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,35A089A6,?,?,?,?,?,0042BEA8,000000FF,0041C5BF,?,?), ref: 0041C1FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,0042BEA8,000000FF,0041C5BF,?,?), ref: 0041C279

Strings

PTn, xrefs: 0041C212, 0041C243

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: PTn
API String ID: 3168844106-3877643181
Opcode ID: 8965e7820ab05e143a14055c6ca1c15ace38de8a3e8155362b1ceca85fd9a237
Instruction ID: de78da07c04899c8c77929c97aee399886044714f0d20352497b2a5157ff95ff
Opcode Fuzzy Hash: 8965e7820ab05e143a14055c6ca1c15ace38de8a3e8155362b1ceca85fd9a237
Instruction Fuzzy Hash: 8F2105BA200B009FD350DF59DAC0A6BB3F9FB88710F544A1DF65A93B50C774B8068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406930 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,35A089A6,?,?,00000000,35A089A6,?,?,?), ref: 00406965
GetLastError.KERNEL32(?,?), ref: 0040696F
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000004,?,?), ref: 004069B5

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 09fedd525c91c46e77d549ea5cb71cab928228c9b59ed4ab44ca6ba5e70dc188
Instruction ID: 07c36081a8cf2dc79f657bfda38f72f695a10e805b8cff717bcdba199a8b3ed4
Opcode Fuzzy Hash: 09fedd525c91c46e77d549ea5cb71cab928228c9b59ed4ab44ca6ba5e70dc188
Instruction Fuzzy Hash: D611F3B25083149FC210EF259C81A1BB7D8FB85764F410A3EF595A73C1C739E905CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00413890 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 004138CC
GetLastError.KERNEL32 ref: 004138E1

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6c661a8d229cc777c08ed75c1f6bd61d8eaa686054be378eced9a4eb92950332
Instruction ID: d5bed59300834c27db51d3e3e8804af017eb22c56735c72e24745968a0aac8e0
Opcode Fuzzy Hash: 6c661a8d229cc777c08ed75c1f6bd61d8eaa686054be378eced9a4eb92950332
Instruction Fuzzy Hash: CE11E1B661120A8B8310DF2DE8409EB77D8AB85321F10822BFD18C7310D236D95A97F9

Uniqueness

Uniqueness Score: -1.00%

Function 00421023 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00423265: TlsGetValue.KERNEL32(?,0042102E), ref: 0042326E
Part of subcall function 00423265: TlsSetValue.KERNEL32(00000000,0042102E), ref: 0042328F

Part of subcall function 00423245: TlsGetValue.KERNEL32(?,?,00421039,00000000), ref: 00423253

GetLastError.KERNEL32(00000000,?,00000000), ref: 00421050
ExitThread.KERNEL32 ref: 00421057
GetCurrentThreadId.KERNEL32 ref: 0042105D

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast
String ID:
API String ID: 1890717252-0
Opcode ID: c00acaf4266d19e5d9d4bfebc160deac36d2b180b2bae20bb46cd11b0c97e720
Instruction ID: ac458970b274fa377b2d346be178e4a5aabec80b7a813b2af96a27a2eaab62bb
Opcode Fuzzy Hash: c00acaf4266d19e5d9d4bfebc160deac36d2b180b2bae20bb46cd11b0c97e720
Instruction Fuzzy Hash: 4101AC70700260EBC714BF62F90990E37B8AF553497A040ABF50587222DB3CD943CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004148C0 Relevance: 3.8, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,35A089A6,?,?,?,?,?,0042BEA8,000000FF), ref: 004148EE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,0042BEA8,000000FF), ref: 0041491B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042BEA8,000000FF), ref: 00414954

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 8e528e502c537d0b69e499d11ca13bb5c5ec1de1f9027612ed72021158fe6829
Instruction ID: 625b76eddf601073e9c329e31110d9aa6d4444885a5d27fa199e2bc448fd388d
Opcode Fuzzy Hash: 8e528e502c537d0b69e499d11ca13bb5c5ec1de1f9027612ed72021158fe6829
Instruction Fuzzy Hash: CB1117B6208650AFD300CF59D980F6BB7E8FBC8B20F60452EF615D3350D775A9068BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(00000000,mia,00000000,?,00000000,35A089A6,00407773,35A089A6,00000004,35A089A6,00000000,?,?,00000000,?), ref: 0040766E

Strings

mia, xrefs: 00407668

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileNameTemp
String ID: mia
API String ID: 745986568-834928705
Opcode ID: 91ff85b098e991700fcb46d4f0a7d15549d180b965abfbab977b0fb5837ae3f1
Instruction ID: fab8d13fb08992a67c48349e1e354a0264bd0400b9f99db237117d7352dc61b1
Opcode Fuzzy Hash: 91ff85b098e991700fcb46d4f0a7d15549d180b965abfbab977b0fb5837ae3f1
Instruction Fuzzy Hash: 2AF08971A04A115BE760DB2DC801757B3E5EF94710F258C3BE181E32D0E7F8A8D58B59

Uniqueness

Uniqueness Score: -1.00%

Function 004083E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00408406

Strings

out of memory, xrefs: 00408421

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocString
String ID: out of memory
API String ID: 2525500382-2599737071
Opcode ID: 13725d636b88ff8fd5f4f3596f44767d9b62ef17f027a52fb81a274580c37290
Instruction ID: aec7c54f5a2f0369ed48fcd6afc8c6432b74e5c3ee15c3e0c9f0bed6091b2591
Opcode Fuzzy Hash: 13725d636b88ff8fd5f4f3596f44767d9b62ef17f027a52fb81a274580c37290
Instruction Fuzzy Hash: 44F03074314B4256D7149F2A9A10617F2E4EF98744F60C43EE8C9C3691FF38D841831E

Uniqueness

Uniqueness Score: -1.00%

Function 00406F70 Relevance: 3.2, APIs: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00407D60: FindNextFileW.KERNELBASE(35A089A6,?,?,00000000), ref: 00407D8D

FindClose.KERNELBASE(?), ref: 004070A7
FindClose.KERNEL32(?), ref: 00407130

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$Close$ErrorFileFreeHeapLastNext
String ID:
API String ID: 75599382-0
Opcode ID: 146458d03b0ddfb7acac76936b528f83ff8088b17ca806f1c30c1053e68c23bb
Instruction ID: cc9cac371736834354910bd5cd1b867e14824cd5f17210572d58679627a67666
Opcode Fuzzy Hash: 146458d03b0ddfb7acac76936b528f83ff8088b17ca806f1c30c1053e68c23bb
Instruction Fuzzy Hash: F151A2B15083809BC320DF39D881B5BB7E4BF84314F508A2EF5D997391DA39E8498B57

Uniqueness

Uniqueness Score: -1.00%

Function 00421A58 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00421A6D
GetCommandLineA.KERNEL32 ref: 00421B02

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CommandInfoLineStartup
String ID:
API String ID: 582193876-0
Opcode ID: 38a39aeb73bf2e7173b6e4f070e5c862512578e1b3fdaa91549fd01fb2ab9960
Instruction ID: 935b6921e9bc571738380e2031d860571ab393784bdb0857821c0bed948142ed
Opcode Fuzzy Hash: 38a39aeb73bf2e7173b6e4f070e5c862512578e1b3fdaa91549fd01fb2ab9960
Instruction Fuzzy Hash: 9331B470B01334A9DB10BBB2BD46B6E6674AF20719F90456FF401AA1E1EEBC8D41875C

Uniqueness

Uniqueness Score: -1.00%

Function 00406780 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,35A089A6,?,?,00000000,0042B6B8,000000FF,004070B9), ref: 004067B0
SetFileAttributesW.KERNEL32(35A089A6,00000000), ref: 0040680B

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5b3868d93b943efae48f880093a7dcf00f7b0866e36bf908cbcae1e608109585
Instruction ID: 3abfe7707c06ebe879871dbe4fe9751a5188b692b2e6d43a4f0365353a145ddf
Opcode Fuzzy Hash: 5b3868d93b943efae48f880093a7dcf00f7b0866e36bf908cbcae1e608109585
Instruction Fuzzy Hash: C62128B25083118FD310EF24AC01B5BB7D4EB85720F440A2FF955933C0D739A909CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAE0 Relevance: 3.1, APIs: 2, Instructions: 75synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041DB58
PostMessageW.USER32(00000001,00008000,00000000,00000000), ref: 0041DB6E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageObjectPostSingleWait
String ID:
API String ID: 1869837590-0
Opcode ID: 627ec1fdba6808bbe801e4296038a541cf8789fabb4638545bf7f397b6626cea
Instruction ID: f70689f1fa0990ff4c806b016051adae220c096d235ed575134d8d770105b2d3
Opcode Fuzzy Hash: 627ec1fdba6808bbe801e4296038a541cf8789fabb4638545bf7f397b6626cea
Instruction Fuzzy Hash: 2B2190B2A08748AFD720CF59D980B9AF7E8FB59324F10426EE55193780C735BD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004210A6 Relevance: 3.1, APIs: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(?,?,00421023,00000000,?,?), ref: 00421127
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00421131

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: f836f3a5612b81b6d242fef6bf68f0a3a6f628dcc52a2b413912adf7304544da
Instruction ID: e962943f56dbf5af09c7da81f0f6a5c3264a404381241de3fbf0b3df6231d336
Opcode Fuzzy Hash: f836f3a5612b81b6d242fef6bf68f0a3a6f628dcc52a2b413912adf7304544da
Instruction Fuzzy Hash: BA11E672700225EFDB10BFA5FC428AF77A5EF14328B90403FF20597161DB799A518668

Uniqueness

Uniqueness Score: -1.00%

Function 00406DE0 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406780: SetFileAttributesW.KERNELBASE(?,00000000,35A089A6,?,?,00000000,0042B6B8,000000FF,004070B9), ref: 004067B0

DeleteFileW.KERNELBASE(?,35A089A6,?,?,?,00000000,35A089A6,?,00000000), ref: 00406E1F
DeleteFileW.KERNEL32(?,?,?,00000004,?,?,00000000,35A089A6,?,00000000), ref: 00406E63

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: File$Delete$Attributes
String ID:
API String ID: 890995776-0
Opcode ID: a4c654311a422871e41f01ebf7195a200fc4afce3709328d9ae48f9f955de1fa
Instruction ID: da23887d15a8d6a19aae8d093848008d0c976a6323084b2f47239b9cdeb27970
Opcode Fuzzy Hash: a4c654311a422871e41f01ebf7195a200fc4afce3709328d9ae48f9f955de1fa
Instruction Fuzzy Hash: 9411D1B25083449BC200EF25DC41A5BB7D8FF85364F410A3EF596673C1D739A80A8BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406870 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?,35A089A6,00000000,?,?,00000000,000000FF,004070C5,00000000), ref: 004068A2
RemoveDirectoryW.KERNELBASE(?,?,?,00000004,?,00000000,000000FF,004070C5,00000000), ref: 004068E6

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 621f523769aaef9b58c8a91ef20634b5231e089e51fc69d7aa2af418621f3536
Instruction ID: 6976d5837b81d7e19e2d9c0b6484c5b3c993c74492be7e520881c874ba3be3b1
Opcode Fuzzy Hash: 621f523769aaef9b58c8a91ef20634b5231e089e51fc69d7aa2af418621f3536
Instruction Fuzzy Hash: C21103B25083049FD200EF259C81A5BB7D8FB85764F540A3EF595673C1C339A91ACBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DFE Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Part of subcall function 00421F1D: EnterCriticalSection.KERNEL32(?,?,?,004234FE,0000000D,00433868,00000008,00421082,?,00000000), ref: 00421F47

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection
String ID:
API String ID: 2972400715-0
Opcode ID: 7e3986139b8b67c31b0f88678f7bfd5cf2d99dd6cd2fd27712303bc26acdf7ba
Instruction ID: 4a3575ee672623f86528ee1a37db317970acd7e0053c85b255a08892b49a06f0
Opcode Fuzzy Hash: 7e3986139b8b67c31b0f88678f7bfd5cf2d99dd6cd2fd27712303bc26acdf7ba
Instruction Fuzzy Hash: E9018471B04331AADB306FB2BD06B5F7AA09F107A5F91091BF114661E2CB7C8981CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 004139C0 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 004139EE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00413A18

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: a78a2efdd5613b01d2b79f02f39425878d4e99252d466dafbcb7c97e419e4ac0
Instruction ID: e1ab2209f1384d4f2fa4e66112dcc239a9f12346fb3dde1c493d98484847d039
Opcode Fuzzy Hash: a78a2efdd5613b01d2b79f02f39425878d4e99252d466dafbcb7c97e419e4ac0
Instruction Fuzzy Hash: AC016D752043029FD320CF18D840BA777E8AF84741F40892EE485D7290D3B8DD858BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00413820 Relevance: 3.0, APIs: 2, Instructions: 35fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 0041384D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0041386F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 6407f021dffc35e2c3c1c4773c865c1866bb2cf9022ef79f00685affb8ef31de
Instruction ID: f641d7c6c31ab4fa61280dfe541440687991b8de954b03818c422660b77a6340
Opcode Fuzzy Hash: 6407f021dffc35e2c3c1c4773c865c1866bb2cf9022ef79f00685affb8ef31de
Instruction Fuzzy Hash: 22F044B56142029BE314DF18C844B6B73E4BB84706F50C92EF889CB290D778DA46DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBE0 Relevance: 3.0, APIs: 2, Instructions: 33timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 0041BBF8
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0041BC2C

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CallbackDispatcherKillTimerUser
String ID:
API String ID: 45433635-0
Opcode ID: d033354e10069cd3944b8f72e8f620b563b4be52a86df29c28ef20a6ecc5271c
Instruction ID: 3a79594e2e4ba89a1939e98a1d4e93963408e146f71aaaaec97657f73b39a7ed
Opcode Fuzzy Hash: d033354e10069cd3944b8f72e8f620b563b4be52a86df29c28ef20a6ecc5271c
Instruction Fuzzy Hash: 46F09A762047009BD324EB19D844FABF7E9EBE4714F00481EF48647280C7B4EC82CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDA0 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E8), ref: 0041BDAC
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041BDC2

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 2441c42c4b6f22e1cf8c1fee51e8d6bf5436049b2f025d8a7968970b928ded5b
Instruction ID: 60cb442689e21d02718789498e37ea817ec3b23390f51a8d278c0a99377a07cd
Opcode Fuzzy Hash: 2441c42c4b6f22e1cf8c1fee51e8d6bf5436049b2f025d8a7968970b928ded5b
Instruction Fuzzy Hash: 02D0A771780310A7DA344B64FC4AF8273DCAB0CB01F004A5AF24BDB1C0CAB0A4418B18

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00415791,35A089A6), ref: 00414769
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,00415791,35A089A6), ref: 00414797

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0e4be479701c683b50c260801d2e880a7be25350149d4d5141acb3b6feb9e411
Instruction ID: 542480b1d8eb3a287b7ca1102c7a40aaead071fd07a36395327ad36d3e90ae7b
Opcode Fuzzy Hash: 0e4be479701c683b50c260801d2e880a7be25350149d4d5141acb3b6feb9e411
Instruction Fuzzy Hash: 4CF0F631A4072267EB605F26EC857D6A7986B42760F118436F474DB2C0C774D8D28BD4

Uniqueness

Uniqueness Score: -1.00%

Function 004149D0 Relevance: 2.5, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,004157F8,35A089A6), ref: 004149F8
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,004157F8,35A089A6), ref: 00414A24

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b942ac331d50b9ed078247248d033226dec88fd113c0506c2f77df4ba4ab23b1
Instruction ID: 5a3fa2ac8ef23217d4891ebed1f32e095f862d02ae69871e60c5b41101f2b08d
Opcode Fuzzy Hash: b942ac331d50b9ed078247248d033226dec88fd113c0506c2f77df4ba4ab23b1
Instruction Fuzzy Hash: 59F090B17513235BEB604F39AC057D767D86B45BA0F110136F891DB2C0D77498D28BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407D60 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(35A089A6,?,?,00000000), ref: 00407D8D

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d6102d2f79556fb804bc3cdef158af67678b0c0b9c80ec8252fa7e3b88ae394d
Instruction ID: db1d632e28ba83ce996c61ce977e882cbc98f0db580175ffcd9fbd943c47ada1
Opcode Fuzzy Hash: d6102d2f79556fb804bc3cdef158af67678b0c0b9c80ec8252fa7e3b88ae394d
Instruction Fuzzy Hash: A4216D706097409FC724DF25D881A6BB7E0BF88304F40896EE59997381D739F90ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00420EDB Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 75ac3337fd4c4b1908931c5cf1c689c8d1c8be91d30c6be0be3fb32ad1f7f2dc
Instruction ID: 26bac391057fe65c1740df9e2c232788cbe269b23501fca5ae5d16265334a20b
Opcode Fuzzy Hash: 75ac3337fd4c4b1908931c5cf1c689c8d1c8be91d30c6be0be3fb32ad1f7f2dc
Instruction Fuzzy Hash: D711A5327852356AD6316A25BE0166B72D89F11365FD21137F810AA2E3DBEC9C81829D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0041BADF

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9ff0bd8df8b3e03792c25fa20b94eef2b4d4b427d93619a6059a71ce3b869d11
Instruction ID: 3e7fcfab807292a2e376bda8b89e87e695560b0a2a75ea0193b5ac30183f4faa
Opcode Fuzzy Hash: 9ff0bd8df8b3e03792c25fa20b94eef2b4d4b427d93619a6059a71ce3b869d11
Instruction Fuzzy Hash: 8E017C71704726ABCB14AE65C9C0A9EF795FF84790B44852AE20587A40C77AF890C7EC

Uniqueness

Uniqueness Score: -1.00%

Function 004081C0 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,0041EC6D,?,00001000,?,80000000,00000001,35A089A6,?), ref: 004081FC

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7172b6f68366401be356630bd6221e0c059fe72a1489c2c52d4b235dd23c16c7
Instruction ID: 344882e4de680020cf4ff848e1b13181e4dbf44253f8dd695d1efe681d569fc8
Opcode Fuzzy Hash: 7172b6f68366401be356630bd6221e0c059fe72a1489c2c52d4b235dd23c16c7
Instruction Fuzzy Hash: 6FF090722443065BCB54DE89E980B2BF3E8ABE8310F14443FF184DB280DB75A84AC739

Uniqueness

Uniqueness Score: -1.00%

Function 004071B0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNELBASE(?,?,00000105), ref: 004071DC

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: a34fcc026e5eddb0abd216ec2ac06cbd66b9c2a377ebd18c04affc28681fd9f6
Instruction ID: bb03d8354c47a3f1518cb96bd69e0356edef982ec88e3c7f4cbd0e2162754a91
Opcode Fuzzy Hash: a34fcc026e5eddb0abd216ec2ac06cbd66b9c2a377ebd18c04affc28681fd9f6
Instruction Fuzzy Hash: 70F09071A146104AE324CB6CD805957B3E6EF98710F24843EE086EB3C1F6B4A8D28755

Uniqueness

Uniqueness Score: -1.00%

Function 004075E0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?,00000004,00407731,00000004,35A089A6,00000000,?,?,00000000,?,?,00000000), ref: 00407609

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: ce42f76a6e4a08daa65f762c9b60fd1b6d081efab45241d6b49ae351743e7067
Instruction ID: 68fae374c04cf999103e7eb2464c69c75c241746d07472e689ce900bf412340b
Opcode Fuzzy Hash: ce42f76a6e4a08daa65f762c9b60fd1b6d081efab45241d6b49ae351743e7067
Instruction Fuzzy Hash: 84F082306046105BE7749F28EC42BA733E1EB48710F24487AE586DB2D0D6F468C28759

Uniqueness

Uniqueness Score: -1.00%

Function 00407BE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00407AC0: FindClose.KERNEL32(?,35A089A6,?,?), ref: 00407B10
Part of subcall function 00407AC0: FindFirstFileW.KERNELBASE(?,?,35A089A6,?,?), ref: 00407B2A
Part of subcall function 00407AC0: FindFirstFileW.KERNELBASE(?,?), ref: 00407B7E

FindClose.KERNEL32(FFFFFFFF,?,35A089A6,00000000,?,?,0042CDA8,000000FF,004185F5,?), ref: 00407C2E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6c08d5d5c73984ff19fc94b1beb69e089bece98d3ab973c1c2cb81dc39aa8a1f
Instruction ID: 82d1cd481473c7c660dfbb2f871a6913d5477604bf1c6d76b04acfc675b75649
Opcode Fuzzy Hash: 6c08d5d5c73984ff19fc94b1beb69e089bece98d3ab973c1c2cb81dc39aa8a1f
Instruction Fuzzy Hash: 49F012B5648640AFD314CF14C885B5BB7E4EB55730F508B2EF865837D0D738A5058A55

Uniqueness

Uniqueness Score: -1.00%

Function 00421D71 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00421D86

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0cda041672ff756b0c41609eb62c40a4d8100e3eb3300feebbfe4dd53f538022
Instruction ID: 474048e3887c1b198e73afb4c75b232851880925ce40373f535b8a9ed00aa635
Opcode Fuzzy Hash: 0cda041672ff756b0c41609eb62c40a4d8100e3eb3300feebbfe4dd53f538022
Instruction Fuzzy Hash: 92D05E32A60345AEDB105F71BC087727BDC9384395F444436B91DC61D0E674D9518608

Uniqueness

Uniqueness Score: -1.00%

Function 00420FA5 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 00420FDB

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 80a01ca7609d5c989842f362529a1f62e76a78053e1eadb625ad7ffcc62f00cd
Instruction ID: e4d375fbbcc4364e754cd5714ee3cf852806fdbcd81a02de693fee1c1a3a24a8
Opcode Fuzzy Hash: 80a01ca7609d5c989842f362529a1f62e76a78053e1eadb625ad7ffcc62f00cd
Instruction Fuzzy Hash: 6CD0C2307412A05ADB203B22FE0E61736A84F04306FD11036F401C45E2CEBCC941C91C

Uniqueness

Uniqueness Score: -1.00%

Function 00422C80 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

Part of subcall function 00422C55: GetModuleHandleW.KERNEL32(mscoree.dll,?,00422C8D,?,?,00420F14,000000FF,0000001E,?,00423A5F,?,00000001,?,?,00421EA7,00000018), ref: 00422C5F
Part of subcall function 00422C55: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00422C6F

ExitProcess.KERNEL32 ref: 00422C91

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID:
API String ID: 75539706-0
Opcode ID: fc79cb4a7c75e363490d362e0a29c1fa0792ec12669b4d022235d3ed5050525d
Instruction ID: e8b23ca0be1445246cfa665b12da37794814825febd1767cce8e84558c35c2c0
Opcode Fuzzy Hash: fc79cb4a7c75e363490d362e0a29c1fa0792ec12669b4d022235d3ed5050525d
Instruction Fuzzy Hash: 69B04831100108BBAB112B13ED0A8693E2AEA802A0B904025B809091219AB2A9A3AA88

Uniqueness

Uniqueness Score: -1.00%

Function 00415310 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,35A089A6,?,?,0042B74B,000000FF), ref: 0041534C

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 64b23c1747a59f00b3a7cb71c49a0bb61e7895e5ecc26e207c38e6798bb42fa8
Instruction ID: 45228e7dd2016b5ef2fd0bc3b159d9bd00e66ae215068ebcedc432afdcfb51ae
Opcode Fuzzy Hash: 64b23c1747a59f00b3a7cb71c49a0bb61e7895e5ecc26e207c38e6798bb42fa8
Instruction Fuzzy Hash: 13F0F675604B419BD320CF15C840B57B7E8FB88760F148A29E5A6877E0D779E844CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00415390 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,35A089A6,?,?,0042B71B,000000FF), ref: 004153CB

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9e23df7032f1c1c763019a4865475cb3fd46ef146c702e0662e34135316dac18
Instruction ID: 20b1c5693166b8bca95178b271d56a26094c7afef8293269c8dfa1a5887baf42
Opcode Fuzzy Hash: 9e23df7032f1c1c763019a4865475cb3fd46ef146c702e0662e34135316dac18
Instruction Fuzzy Hash: 58F01975604B419FD320CF18D840B57B7E8FB88B60F104A29E9A5877D0D779E844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004150E0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00415105

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 91e7c122242a59b9ccdf0bc7cab8ba7e8ce12b952b763bfd60d325ca9c1f4047
Instruction ID: 0420e787cb9a86eed4a7b4d6ef3617ecd3e0c8e4f838007923f70c7bb3aee507
Opcode Fuzzy Hash: 91e7c122242a59b9ccdf0bc7cab8ba7e8ce12b952b763bfd60d325ca9c1f4047
Instruction Fuzzy Hash: FBE0C2B13142016BF3259B748C46FA7339C9B90704F20403FB106CE2C0EBA5D950823D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408DD0 Relevance: 31.1, APIs: 15, Strings: 2, Instructions: 1315COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,0042FFD8), ref: 00409192

Strings

@KA, xrefs: 00408EA3
@KA, xrefs: 00408F00

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalDeleteSection
String ID: @KA$@KA
API String ID: 166494926-2499244848
Opcode ID: 2173faeb293dca02ee19f3e9e51af43ddb57dbe41030808bd3abe99407723cfe
Instruction ID: 101a39299099d8b7fbc73b7120cb9860c9e9d9b4841921f6e0cd10bc3771a624
Opcode Fuzzy Hash: 2173faeb293dca02ee19f3e9e51af43ddb57dbe41030808bd3abe99407723cfe
Instruction Fuzzy Hash: B0C25A716083818FC320DF69C480B9BBBE4BFC9304F14896EE58997392DB75A945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00425561 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 128libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library), ref: 00425589
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004255A5

Part of subcall function 0042314F: TlsGetValue.KERNEL32(00000000,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 00423161
Part of subcall function 0042314F: TlsGetValue.KERNEL32(00000005,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 00423178

GetProcAddress.KERNEL32(00000000,00000000), ref: 004255C2

Part of subcall function 0042314F: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 0042318E
Part of subcall function 0042314F: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004231A9

GetProcAddress.KERNEL32(00000000,00000000), ref: 004255D7
GetProcAddress.KERNEL32(00000000,00000000), ref: 004255EC
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00425604

Strings

GetLastActivePopup, xrefs: 004255CA
GetActiveWindow, xrefs: 004255B5
USER32.DLL, xrefs: 00425584
GetProcessWindowStation, xrefs: 004255FE
GetUserObjectInformationA, xrefs: 004255DF
MessageBoxA, xrefs: 0042559F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AddressProc$Value$HandleLibraryLoadModule
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2739679353-232180764
Opcode ID: eda493182502602d78804c1dcaf6d901c150ed2079cc82df330cf64e554991c4
Instruction ID: ea4f8d63e2448dcebdce051990e56d3433885cbb053dcb12d77742c4b55e84ad
Opcode Fuzzy Hash: eda493182502602d78804c1dcaf6d901c150ed2079cc82df330cf64e554991c4
Instruction Fuzzy Hash: A5419871F04722AADB10AFB5BC05A7B7AB8AF40751BD8042BE408D6291DBBCDD508A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00423B3C Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00423C18
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00423C22
UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00423C2F
GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00423C4A
TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00423C51

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 28abf845cb6c40201863f7eb85ba11f7b915c65e1d0012d16df31474ab224b33
Instruction ID: d83251fa16af329b4315153c2e38519d9b9d51a5e64fd7ff99532e3034369041
Opcode Fuzzy Hash: 28abf845cb6c40201863f7eb85ba11f7b915c65e1d0012d16df31474ab224b33
Instruction Fuzzy Hash: 4231E8B1E113289BDB60DF65DD897D8BBB8AF18304F5040EAE50DA6250EB785F818F08

Uniqueness

Uniqueness Score: -1.00%

Function 00420DEF Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00421C9B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00421CB0
UnhandledExceptionFilter.KERNEL32(0042E368), ref: 00421CBB
GetCurrentProcess.KERNEL32(C0000409), ref: 00421CD7
TerminateProcess.KERNEL32(00000000), ref: 00421CDE

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6dce4c989cf31f9a2636c4ce92163af802b09ed08417ef6bccfbb8f4d1c3d290
Instruction ID: e4562c502b537d5cccca84f566efa76d5afb76e5238d3ce5c2676c7199ec694f
Opcode Fuzzy Hash: 6dce4c989cf31f9a2636c4ce92163af802b09ed08417ef6bccfbb8f4d1c3d290
Instruction Fuzzy Hash: 9C21BAB9A04200AFDB10DF6AF8496953BF0BB0C710F80607AEA09873A1E7B45D91CF0D

Uniqueness

Uniqueness Score: -1.00%

Function 004250BC Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004250F3
GetCurrentProcessId.KERNEL32 ref: 004250FF
GetCurrentThreadId.KERNEL32 ref: 00425107
GetTickCount.KERNEL32 ref: 0042510F
QueryPerformanceCounter.KERNEL32(?), ref: 0042511B

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 35849d5ae6893442137a7b63ded673c0d501242e2656aa3c6f61a9e853f2a60e
Instruction ID: 5884621900dd183efe006d37875236d81a61058141d2cd9c3fa534dfe45ae878
Opcode Fuzzy Hash: 35849d5ae6893442137a7b63ded673c0d501242e2656aa3c6f61a9e853f2a60e
Instruction Fuzzy Hash: 9611A972E002389FDB209BB5EC4866AB7F4EF4C351FD20571D541E7210DA749D01C798

Uniqueness

Uniqueness Score: -1.00%

Function 004128A0 Relevance: 5.0, APIs: 3, Instructions: 465synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

SetEvent.KERNEL32(?,00000000,?,?,?,?,?,?,?,00433B9C), ref: 00412CDB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 00412CE1
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,00433B9C), ref: 00412D24

Part of subcall function 00415180: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 00415195
Part of subcall function 00415180: GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 0041519E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorEventLast$CreateExceptionObjectRaiseSingleWait
String ID:
API String ID: 1996610700-0
Opcode ID: 4d39b91e3f8c64d9e1cd22e97cb076a47efb473c21de60c66e173e9c86d92202
Instruction ID: 0a967a9db4ba4e0fb76a007f6e616d88927016828e0849af8afb68f1a4c9ab52
Opcode Fuzzy Hash: 4d39b91e3f8c64d9e1cd22e97cb076a47efb473c21de60c66e173e9c86d92202
Instruction Fuzzy Hash: B8028F746047029FC764DF28C580AAAB3E1FF88304F248A1EE595C7351D774F8A6CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004240E4 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004241E0
UnhandledExceptionFilter.KERNEL32(?), ref: 004241ED

Part of subcall function 00422F34: GetModuleFileNameA.KERNEL32(00000000,00439779,00000104), ref: 00422FD7

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$FileModuleName
String ID:
API String ID: 787209826-0
Opcode ID: 25cc7d49b9454689ddfc9af2ac2f9835beff2613ad77b6a286ddb831ceea68db
Instruction ID: e82509b2808dd087b6cc8addbea33cb8face3e593dbea50d11c58a0f20d52b25
Opcode Fuzzy Hash: 25cc7d49b9454689ddfc9af2ac2f9835beff2613ad77b6a286ddb831ceea68db
Instruction Fuzzy Hash: E52126B0D0132D9ACB21DF65AC897C9BBB4BF18304F5000EAA50CA6251DBB84FC0CF48

Uniqueness

Uniqueness Score: -1.00%

Function 004011C0 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24e76e97f088ff2340df07ce6d8eaf1190ca0a9df6fc331afb225c23a03e0c0
Instruction ID: 6ec0d9b20c51930400a28b2cf4c630a1cacc779d3f08c7b5f658bb3cc2d65df3
Opcode Fuzzy Hash: b24e76e97f088ff2340df07ce6d8eaf1190ca0a9df6fc331afb225c23a03e0c0
Instruction Fuzzy Hash: 74511A31B106204AF30CCF769C842A67BD3DBC9386B44D63DE295DA6D8DABDC017C698

Uniqueness

Uniqueness Score: -1.00%

Function 004011D8 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c170e2161206dc0ced38249dd021522e111bee97a1422566ba6a8047c7c9086
Instruction ID: 8fa4896d0c32512dfa3da576777b2c050686be6e2d8f2528dbc2fa637e1ff780
Opcode Fuzzy Hash: 2c170e2161206dc0ced38249dd021522e111bee97a1422566ba6a8047c7c9086
Instruction Fuzzy Hash: BB510731B106200AF308CF369C842A67BD3DBC9386B44D23DD695DA6E8DABDC017C698

Uniqueness

Uniqueness Score: -1.00%

Function 0040E440 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

, xrefs: 0040E608

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-3916222277
Opcode ID: 48082f854bff1add32f48e4266824b0ab221c14decb41c0ecf9b5038d6d03464
Instruction ID: 4905a2555361d4b40396e2ad8604d136661ad17ace758740d79296136a4cd9e7
Opcode Fuzzy Hash: 48082f854bff1add32f48e4266824b0ab221c14decb41c0ecf9b5038d6d03464
Instruction Fuzzy Hash: B5E191716043018FC714DF2AC48052BB7E5EF89328F548D3FE895A7391DA39E865CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004295EA Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,?,?,?,?,00000000), ref: 0042960E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 54a90aea609222d28112c1eaa106de384f8d0ce6c8b0134624755defd90b07d8
Instruction ID: 973265b16e2cb84984fe7449b7d49a156527acce62ffe282a182c70b07d50db1
Opcode Fuzzy Hash: 54a90aea609222d28112c1eaa106de384f8d0ce6c8b0134624755defd90b07d8
Instruction Fuzzy Hash: C0F06530B04218ABDB10DBB5E846B9E77F9AF48314F90416AF511D61C1DFB4DA04C61D

Uniqueness

Uniqueness Score: -1.00%

Function 00424945 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00024903), ref: 0042494A

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 24524984a58f72cb7fe12606cdfcc85d318e1795a0ded427764ce3f430ceae39
Instruction ID: 02c8abee07370e7cb003beee7d17bd52556d1210545f2270e595cfdec49312d0
Opcode Fuzzy Hash: 24524984a58f72cb7fe12606cdfcc85d318e1795a0ded427764ce3f430ceae39
Instruction Fuzzy Hash: F69002B03551154A662017716D4A71A29909AA86027D114716205C415CDAA44052551F

Uniqueness

Uniqueness Score: -1.00%

Function 004102D0 Relevance: .9, Instructions: 901COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f1eac608253b4fa400cd88ccec21fbfb64af6ca787b348a66882f4047c332a
Instruction ID: 01a91eeea2aff737d0b365e6c57a033e2f99f4b8156a15c0193d14d1a608853e
Opcode Fuzzy Hash: 02f1eac608253b4fa400cd88ccec21fbfb64af6ca787b348a66882f4047c332a
Instruction Fuzzy Hash: 1D9228B1508381CFC734DF59C480A9BBBE1BF89304F14892EE59A97351D7B8A885CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405510 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeap
String ID:
API String ID: 2584219951-0
Opcode ID: 46391849c57e93a8729d2033434e9fb67e9fe17df0031d36261b6a635283fe9f
Instruction ID: 94e795bf1a0c9910044c3c2dd5c4af4e6959a853943c1580eb38ed7d93358e0f
Opcode Fuzzy Hash: 46391849c57e93a8729d2033434e9fb67e9fe17df0031d36261b6a635283fe9f
Instruction Fuzzy Hash: FD222871608B908FC7219F39858466BBBD5EF95304F484A2EF8C5A7382D27CE905CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040EFF0 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cd1e4bd61910ee9209f8ab130cbb053367805de08f4fd01a039497d7822f7e
Instruction ID: e349e95833274217d244d427187e591f8dca3494776eda759b979b6953068a50
Opcode Fuzzy Hash: 58cd1e4bd61910ee9209f8ab130cbb053367805de08f4fd01a039497d7822f7e
Instruction Fuzzy Hash: 0C223774504341DFC724DF15C480A6AB7E1FB88314F14897EE899AB792DB39EC4ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 00403760 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction ID: c2d97246fd2aafeb022947b6bb86a1446f9da4e42c3c7867536164bb694cac53
Opcode Fuzzy Hash: 9803c8db8919b39b22e60e951130245479d9368fb12c4fe1c3f5fb4592283aad
Instruction Fuzzy Hash: 80024C72A042114BD708CE18C580279BFE6FBC5346F114A3FE496A77C4D778DA88CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040D900 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375dd9bf2b93ec9fd52bb82df78b016270cadd8972f0c5003f6c71272566d0b8
Instruction ID: e10f0c9767169ad6ca306e4759b4dee7f78dd904dd151e380c46861b78301315
Opcode Fuzzy Hash: 375dd9bf2b93ec9fd52bb82df78b016270cadd8972f0c5003f6c71272566d0b8
Instruction Fuzzy Hash: 1CE133B09083808FD764DF68C480B6BBBE1FF89304F51492EE999A7391D774A849CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a52f6b36d15c3f10d6125d052433a857e5dbc77148c06f91a25cd1f24f5737b
Instruction ID: 1e9a4df9b44ad6f4c50e22b14f2fef7b674a283b03798b1cf1174821231ddd43
Opcode Fuzzy Hash: 0a52f6b36d15c3f10d6125d052433a857e5dbc77148c06f91a25cd1f24f5737b
Instruction Fuzzy Hash: 4BD1BD728446A64FE318DF5DDC80235B772EF88310F6A457DC7981B3A2CA34BA21DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00401AB0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e26577fba095136f5744b22ad2f39cb0c53c06d26df2648a4839c972093248a
Instruction ID: a133422d40a656bc7bcaeb9e216c34e50bde69e37971f087a7cef11d5dbccbab
Opcode Fuzzy Hash: 7e26577fba095136f5744b22ad2f39cb0c53c06d26df2648a4839c972093248a
Instruction Fuzzy Hash: 8AD1CC328546A64FE318DF59DC9033577A3EFC8350F2E0279CB950B692CB38A611DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042244E Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
Instruction ID: 983ecf99ccd27684851fe3aac58d00a589f3145670afc011b7ace4e69248badb
Opcode Fuzzy Hash: b0a81e3d32886a3826879c9bb5c7ff7792f7acd020c85209a7aca5b77f0b2be7
Instruction Fuzzy Hash: 3CB18D36A0021AEFCB15CF04D6D0AA8FBA1BF58318F54C19ED81A5B342D775EE46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004045A0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction ID: 57494768f0b92b70c1e5fb60671f8c0904b92fa69cceb7a89f96e62002fbccdf
Opcode Fuzzy Hash: ed524da47b8aa2ae254806281c4a749b71c931bd55644e6fcbbed78bd4e0280e
Instruction Fuzzy Hash: 7E61F4112197D29FD311CE3D488026CFFE1EFA71047588B6ED8D287B86C668E56AC7E1

Uniqueness

Uniqueness Score: -1.00%

Function 004042D0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3729e50029bc6c3d4b5788440f5fe005dccf0ff45094f581cd922932bb4b71
Instruction ID: bfe1c4857090628bc31f33145390d4079553c539c8f45b3f89973d2b226e20e8
Opcode Fuzzy Hash: dd3729e50029bc6c3d4b5788440f5fe005dccf0ff45094f581cd922932bb4b71
Instruction Fuzzy Hash: B6613A725087118FC318DF49D48494AF3E1FFC8318F1A8A6DEA885B361D771E959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004013F0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fc0aad63f55b9cb06e14c9a54f79600626f447b6889b17ae8838990c2708ce
Instruction ID: 40e91ebcbfae1216bfcaa19984515f511dc88b32e75e61ccbef25afa7c8177b3
Opcode Fuzzy Hash: 51fc0aad63f55b9cb06e14c9a54f79600626f447b6889b17ae8838990c2708ce
Instruction Fuzzy Hash: FB317F71A0437607E3249E2E8C80126FBE39FD1301F19C27EE69C8B75AD839954A8254

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d56deecd46ef8ef1f69f9754baeca6b831613f74d6383f3ce14ec95c9c5be60
Instruction ID: c5ec1d2ed9afae8cad4480c0fdb6b25e0a32306f29324575231a0c6ad83db5c9
Opcode Fuzzy Hash: 6d56deecd46ef8ef1f69f9754baeca6b831613f74d6383f3ce14ec95c9c5be60
Instruction Fuzzy Hash: 81110A3E370D0607E71C8769AD73AB921C1E384309B88A13DF68BC96D1EE6D9894C20D

Uniqueness

Uniqueness Score: -1.00%

Function 00401100 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction ID: 745e0ab5a1f4135cb869288e75bb92ef0094498d29e0feb23aae1f7a6adb8ed7
Opcode Fuzzy Hash: 9de65a982604af57022305bde5ac8764cd96b40e1cb3bce903844e2d22169a83
Instruction Fuzzy Hash: 0111CE37A54A270BD324A96CDC80B777392EB8A354F1A4271DF449F392D538A94282E8

Uniqueness

Uniqueness Score: -1.00%

Function 0042360A Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00423614
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0042363B
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00423648
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00423655
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00423662
TlsAlloc.KERNEL32 ref: 004236B2
TlsSetValue.KERNEL32(00000000), ref: 004236CD
GetCurrentThreadId.KERNEL32 ref: 0042377C

Part of subcall function 00422BFC: Sleep.KERNEL32(000003E8,?,?,00423219,KERNEL32.DLL,?,00423285,?,0042102E), ref: 00422C08
Part of subcall function 00422BFC: GetModuleHandleW.KERNEL32(?,?,?,00423219,KERNEL32.DLL,?,00423285,?,0042102E), ref: 00422C11

Part of subcall function 004232B6: TlsFree.KERNEL32(0000000D,00423792), ref: 004232E1

Strings

FlsFree, xrefs: 00423657
FlsAlloc, xrefs: 00423635
KERNEL32.DLL, xrefs: 0042360E, 00423613, 0042361E
FlsSetValue, xrefs: 0042364A
FlsGetValue, xrefs: 0042363D

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AddressProc$HandleModule$AllocCurrentFreeSleepThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3443574016-3819984048
Opcode ID: a7711aafff6d1c943812970f45cdda8508d32c6994b3b679bdc38e784271ccf6
Instruction ID: 659c3cc02cf5ae5a470aa70da44ff7c46ddd0b0c312864a7ea5dc2d590450fdb
Opcode Fuzzy Hash: a7711aafff6d1c943812970f45cdda8508d32c6994b3b679bdc38e784271ccf6
Instruction Fuzzy Hash: 123192B1B04370AACB207F76BC09A563FB4AB84725790563FE415927B0DBBC8941EB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 95synchronizationwindowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,35A089A6,?,?,?,?,?,?,0042C340,000000FF), ref: 0041D255
LeaveCriticalSection.KERNEL32(?), ref: 0041D28C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D29E
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041D2A8
PostMessageW.USER32(?,?,?,?), ref: 0041D2C3
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041D2CF
CloseHandle.KERNEL32(?), ref: 0041D2D5
EnterCriticalSection.KERNEL32(?), ref: 0041D2EE
LeaveCriticalSection.KERNEL32(?), ref: 0041D317

Strings

PTn, xrefs: 0041D25F, 0041D2F8

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait$CloseCreateEventHandleMessagePost
String ID: PTn
API String ID: 3292403733-3877643181
Opcode ID: b9247c5f70dafe7bfc19e6b92135a0c60dfd878217866a3eae6bc9666be4be80
Instruction ID: ad018f8797b644248f86de4a6b73993a128294163a90829cbb7abac7b6748e62
Opcode Fuzzy Hash: b9247c5f70dafe7bfc19e6b92135a0c60dfd878217866a3eae6bc9666be4be80
Instruction Fuzzy Hash: FA3117B16047409FD320CB69CC84B67B7E8BB89724F104A1DE5A993790CB74A8068B69

Uniqueness

Uniqueness Score: -1.00%

Function 004287F0 Relevance: 16.8, APIs: 11, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042FC04,00000001,00000000,00000000,00000100,?,00000000,?,?,?,?,?,?,?), ref: 00428822
GetLastError.KERNEL32 ref: 00428834
MultiByteToWideChar.KERNEL32(00000100,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,?,?,?,?), ref: 004288C0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0042892C
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 00428948
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00428982
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 004289E6
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 00428A09
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000100,?,00000000,?,?,?,?), ref: 00428A99
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000100,?,00000000,?), ref: 00428B0B
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,00000100,?,00000000,?,?,?,?,?,?,?), ref: 00428B58

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 0622c9595e7c928c67a9354684f3a0c5ff4f8ed5d5a964f2728db9e7a2ec57f5
Instruction ID: 62a6f68c45b0641a106a5d19d1630dbcff62c7981991ce5b33db095deec397d3
Opcode Fuzzy Hash: 0622c9595e7c928c67a9354684f3a0c5ff4f8ed5d5a964f2728db9e7a2ec57f5
Instruction Fuzzy Hash: 0EB1B3B2A01029EFDF219F95EC808AF7BB5FB48314F94442FF905A6210DB398D91DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00406250 Relevance: 16.7, APIs: 11, Instructions: 177windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004062A1
SetForegroundWindow.USER32(00000000), ref: 004062A8
ShowWindow.USER32(?,00000005), ref: 00406324
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040633C
DialogBoxParamW.USER32(00400000,?,?,Function_00006160,?), ref: 00406359
SetEvent.KERNEL32(?), ref: 00406366
ShowWindow.USER32(?,00000005), ref: 00406377
PeekMessageW.USER32(00000000,?,00000000,00000000,00000000), ref: 0040638C
MessageBoxW.USER32(?,?,?,?), ref: 004063A2
SetEvent.KERNEL32(?), ref: 004063AF

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Window$Message$EventPeekShow$DesktopDialogForegroundParam
String ID:
API String ID: 1049595212-0
Opcode ID: b861efee7c899d3e4e1076c67bf2fbbf407496ad3a32fa7bdceb73dce1f1e3b2
Instruction ID: 5797e6bae45bfa39f825304b1f8ed8a4465e7a28c84138b089b3a73a73e676b4
Opcode Fuzzy Hash: b861efee7c899d3e4e1076c67bf2fbbf407496ad3a32fa7bdceb73dce1f1e3b2
Instruction Fuzzy Hash: EA517D763002019FD224DF59E888F6BB3A9EBD8711F11852EF64687391C631EC56CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 00425B16 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 00425B30
InterlockedDecrement.KERNEL32(?), ref: 00425B3D
InterlockedDecrement.KERNEL32(?), ref: 00425B4A
InterlockedDecrement.KERNEL32(?), ref: 00425B57
InterlockedDecrement.KERNEL32(?), ref: 00425B64
InterlockedDecrement.KERNEL32(?), ref: 00425B80
InterlockedDecrement.KERNEL32(00000000), ref: 00425B90
InterlockedDecrement.KERNEL32(?), ref: 00425BA6

Strings

8tC, xrefs: 00425B70

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: DecrementInterlocked
String ID: 8tC
API String ID: 3448037634-1908392418
Opcode ID: 68b8d37a790ab26a57f16d1a8e67aef492bf5187288d27573ff4109d657d946d
Instruction ID: 26d9552eaaefea0de38b777c8ec2ad1a3221d05d0ca2cf7801aa64a1755bbd99
Opcode Fuzzy Hash: 68b8d37a790ab26a57f16d1a8e67aef492bf5187288d27573ff4109d657d946d
Instruction Fuzzy Hash: BC110071B00A25A7DB209F69DC88F57FB9CAF44794F884427A508D7241D778FD10CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00425A87 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 00425A99
InterlockedIncrement.KERNEL32(?), ref: 00425AA6
InterlockedIncrement.KERNEL32(?), ref: 00425AB3
InterlockedIncrement.KERNEL32(?), ref: 00425AC0
InterlockedIncrement.KERNEL32(?), ref: 00425ACD
InterlockedIncrement.KERNEL32(?), ref: 00425AE9
InterlockedIncrement.KERNEL32(00000000), ref: 00425AF9
InterlockedIncrement.KERNEL32(?), ref: 00425B0F

Strings

8tC, xrefs: 00425AD9

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: IncrementInterlocked
String ID: 8tC
API String ID: 3508698243-1908392418
Opcode ID: db4b19f6db7c05c65b1895c93acde5521fd8d44035fd7f8515e16809a9c5ebee
Instruction ID: 4c0a2427404962645bda0b9b296f8371433b32c1a7d54b2745580576d5f3866b
Opcode Fuzzy Hash: db4b19f6db7c05c65b1895c93acde5521fd8d44035fd7f8515e16809a9c5ebee
Instruction Fuzzy Hash: D8110C71B01A29ABDB10DB69ECC9B57B7ACAF44754F488527A408D7240DB78E810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004232F3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00433840,0000000C,0042342E,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00423305
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00423339
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00423349
InterlockedIncrement.KERNEL32(00437528), ref: 00423378

Part of subcall function 00422BFC: Sleep.KERNEL32(000003E8,?,?,00423219,KERNEL32.DLL,?,00423285,?,0042102E), ref: 00422C08
Part of subcall function 00422BFC: GetModuleHandleW.KERNEL32(?,?,?,00423219,KERNEL32.DLL,?,00423285,?,0042102E), ref: 00422C11

Strings

KERNEL32.DLL, xrefs: 004232FF, 00423304, 0042330F
EncodePointer, xrefs: 0042332D
@tC, xrefs: 0042339F
DecodePointer, xrefs: 00423341
(uC, xrefs: 00423362

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AddressHandleModuleProc$IncrementInterlockedSleep
String ID: (uC$@tC$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 3998264955-3985925910
Opcode ID: e6ef39dbce11235577be71a267b04464a0c36bf9595fb088b49917cb53ee76d4
Instruction ID: 368c4239940ca1c59e3d13a91af4f3465ee06113d0ebd32d49dc493fe0e42800
Opcode Fuzzy Hash: e6ef39dbce11235577be71a267b04464a0c36bf9595fb088b49917cb53ee76d4
Instruction Fuzzy Hash: AC11A5B1A00711AED730EF67A805B5ABBF0AF04315F90451FE4A5A72A1CB7C9B41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00424CE5 Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00424D03
GetLastError.KERNEL32 ref: 00424D17
GetEnvironmentStringsW.KERNEL32 ref: 00424D3E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00424D78
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00424D9B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00424DB1
GetEnvironmentStrings.KERNEL32 ref: 00424DC4
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00424DF6
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00424E0F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: 2cfb9a72264fe13fcd3e974b28445dcd2c716c364153f914d8d464fc118721a8
Instruction ID: 247b671838651186a8bd24d1fbe577920d18d8b87e5d1f4aa91061dcb602c5a4
Opcode Fuzzy Hash: 2cfb9a72264fe13fcd3e974b28445dcd2c716c364153f914d8d464fc118721a8
Instruction Fuzzy Hash: 2D310672B10134AEDB216FB5BCC887F7AADEAC53447A40477F142D3201D6385D828769

Uniqueness

Uniqueness Score: -1.00%

Function 00415210 Relevance: 13.6, APIs: 9, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,35A089A6,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 00415252
GetLastError.KERNEL32 ref: 0041525C
WaitForSingleObject.KERNEL32(?,000000FF,35A089A6,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 0041526C
CloseHandle.KERNEL32(?,35A089A6,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 00415284
GetLastError.KERNEL32 ref: 00415290
CloseHandle.KERNEL32(?,35A089A6,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 004152AE
GetLastError.KERNEL32 ref: 004152B4
CloseHandle.KERNEL32(?,35A089A6,?,?,00000000,00000000,0042C471,000000FF,0040AAAB,?,?), ref: 004152CF
GetLastError.KERNEL32 ref: 004152D5

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast$CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2212007442-0
Opcode ID: 2777ae7e726d2c839fa65e51c23003c870152c2d6633ec8b2ef1ac72c44a5693
Instruction ID: bbc22d7d5e4264d147577bd93a02f4c94613573c8b2e1379b6dd7e4c8a38e6fc
Opcode Fuzzy Hash: 2777ae7e726d2c839fa65e51c23003c870152c2d6633ec8b2ef1ac72c44a5693
Instruction Fuzzy Hash: 0F218FB2304B42CBD720CF25DC44B97B7E8EB94760F144A2AE895C7390D739E845CEA9

Uniqueness

Uniqueness Score: -1.00%

Function 00422F34 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00439779,00000104), ref: 00422FD7
GetStdHandle.KERNEL32(000000F4,77A85D90,?,00000000,00000003,00000003,?,0042310B,000000FC,00420F03,?,00423A5F,?,00000001,?), ref: 004230AA
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,0042310B,000000FC,00420F03,?,00423A5F,?,00000001,?,?,00421EA7), ref: 004230D4

Strings

..., xrefs: 00423026
Microsoft Visual C++ Runtime Library, xrefs: 00423098
<program name unknown>, xrefs: 00422FE1
Runtime Error!Program: , xrefs: 00422F99

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: cc9de0986650cee929dc048b5c1b0dddde9dfe506617fdb1c9d096763233a800
Instruction ID: 9158cb6e566bfd08f085ed830427a44525b66a6d665f02bf608d18114e126ccc
Opcode Fuzzy Hash: cc9de0986650cee929dc048b5c1b0dddde9dfe506617fdb1c9d096763233a800
Instruction Fuzzy Hash: E14148A2B0023076E6203A67BD46B7F25689F11746FD4002BF905912C2EABDDF1281BE

Uniqueness

Uniqueness Score: -1.00%

Function 0042618E Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00425F2D: GetOEMCP.KERNEL32(00000000,?), ref: 00425F56

Part of subcall function 00423A4E: Sleep.KERNEL32(00000000,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D,00433868,00000008), ref: 00423A6F

InterlockedDecrement.KERNEL32(?), ref: 00426204
InterlockedIncrement.KERNEL32(00000000), ref: 00426229
InterlockedDecrement.KERNEL32 ref: 004262BB
InterlockedIncrement.KERNEL32(00000000), ref: 004262DF

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Strings

(uC, xrefs: 00426211
(uC, xrefs: 004262CA
(uC, xrefs: 004262FF

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$ErrorFreeHeapLastSleep
String ID: (uC$(uC$(uC
API String ID: 1703371082-3253123444
Opcode ID: d9f6be0851496ed857afd1ddd90e93bab350777af422ca54c1a6e710554727b8
Instruction ID: 17eb0c422dad532322fb8ef44ca996b3933cc8bb414c5f76d99fb5abf9fd75a1
Opcode Fuzzy Hash: d9f6be0851496ed857afd1ddd90e93bab350777af422ca54c1a6e710554727b8
Instruction Fuzzy Hash: CD41C770604224DBDB20EF75F88475A37E0AB04314F9655AFE845DB262CB7C98418B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,35A089A6), ref: 0041BC7D
LeaveCriticalSection.KERNEL32(?), ref: 0041BC87
EnterCriticalSection.KERNEL32(?), ref: 0041BC95
LeaveCriticalSection.KERNEL32(?), ref: 0041BCC6
MessageBoxW.USER32(?,?,?,00000024), ref: 0041BCF5

Strings

PTn, xrefs: 0041BCA3

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Message
String ID: PTn
API String ID: 850481049-3877643181
Opcode ID: 97fca20e87f4d19e08f54edf18e8893c9510420802b076d91891b32d89d837be
Instruction ID: 0a8a3c5dcc9595394f3e91466f479760a0ffc0d599377708b9fa38c2404fa1f7
Opcode Fuzzy Hash: 97fca20e87f4d19e08f54edf18e8893c9510420802b076d91891b32d89d837be
Instruction Fuzzy Hash: 6441AFB1204341AFD324DF28D844B6BBBE4FB89714F100619F56A83391C738E946CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041D100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 85registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,35A089A6,?,?,?,00000000,?,?,0042C7C9,000000FF,0041D69D,?,00000004), ref: 0041D142
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000), ref: 0041D152
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000), ref: 0041D15C

Part of subcall function 004047C0: InitializeCriticalSection.KERNEL32(?,35A089A6), ref: 004047FE

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6), ref: 0041D1DF
GetLastError.KERNEL32(?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000,0042CB29), ref: 0041D1E8

Part of subcall function 0042A355: RaiseException.KERNEL32(?,?,?,00404E9C,?,?,?,?,?,00404E9C,?,00433BD0), ref: 0042A397

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D14A
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D154

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CreateEventMessageRegisterWindow$CriticalErrorExceptionInitializeLastRaiseSection
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 320577460-1515309323
Opcode ID: 8c3c6d63b363685cc27f5696b87a2b9263a8d1f6cc3ee763bcd4ecdd4307727f
Instruction ID: e389b8cf96f7ef14453b2a34cd2d1995612044cb35cd3128fd44df0df899afb7
Opcode Fuzzy Hash: 8c3c6d63b363685cc27f5696b87a2b9263a8d1f6cc3ee763bcd4ecdd4307727f
Instruction Fuzzy Hash: 173170B1604B86AFD314CF29C881B86FFE8FB19354F54462EE16883641C774B554CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00429633 Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,00428790,?,?,?,?,?,?), ref: 0042967E
GetCPInfo.KERNEL32(?,00000001,?,00428790,?,?), ref: 00429697
MultiByteToWideChar.KERNEL32(?,00000001,?,00428790,00000000,00000000,?,00428790,?,?,?,?,?,?,?,?), ref: 004296F5
MultiByteToWideChar.KERNEL32(?,00000001,?,00428790,?,00000000,?,?,?,?,?,?,?,00428790,?,?), ref: 00429744
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00428790), ref: 0042975F
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00428790), ref: 00429785
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00428790), ref: 004297AA

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: efa3d840405d14af4fdc8cd6cc2b4b712fdd27864ef2ab618cb99f6814856607
Instruction ID: 8be41e7a548ec35f8aee705dd7f55362ca18c0eeec8d1ae65a879b8315825ffb
Opcode Fuzzy Hash: efa3d840405d14af4fdc8cd6cc2b4b712fdd27864ef2ab618cb99f6814856607
Instruction Fuzzy Hash: CA516F31E10129EBCF219F96EC84DEFBBB9EF89714F90412AF514A2250D7399C41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2B0 Relevance: 10.7, APIs: 7, Instructions: 156windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0041B2E2
SetWindowTextW.USER32(00000000,?), ref: 0041B2F0

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

SetWindowTextW.USER32(?,?), ref: 0041B347
SetDlgItemTextW.USER32(?,000003E8,?), ref: 0041B3A3
SetDlgItemTextW.USER32(?,00000001,?), ref: 0041B3FC
SetDlgItemTextW.USER32(?,00000002,?), ref: 0041B455
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 0041B467

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Text$Item$Window$ErrorFreeHeapLastMessageSend
String ID:
API String ID: 3032249301-0
Opcode ID: 8616607771760b40af6b41e3cf6a6b38da392e2d415f46127b7d0b13a612a390
Instruction ID: 9124571f9925069902d80d9bec0a2e382c050e0a1f5ab6a584098a3f445e3558
Opcode Fuzzy Hash: 8616607771760b40af6b41e3cf6a6b38da392e2d415f46127b7d0b13a612a390
Instruction Fuzzy Hash: 8C5166B15083809FD700EF69D885B4BBBE8AF88354F40095DF68997292C7B8E545CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0041D5E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041D100: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,35A089A6,?,?,?,00000000,?,?,0042C7C9,000000FF,0041D69D,?,00000004), ref: 0041D142
Part of subcall function 0041D100: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000), ref: 0041D152
Part of subcall function 0041D100: RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000), ref: 0041D15C
Part of subcall function 0041D100: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000004,?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6), ref: 0041D1DF
Part of subcall function 0041D100: GetLastError.KERNEL32(?,?,0042C7C9,000000FF,0041D69D,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000,0042CB29), ref: 0041D1E8

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000004,00000004,00000004,00000004,35A089A6,?,?,00000000,00000000,0042CB29,000000FF), ref: 0041D6BD
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG), ref: 0041D6D4
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX), ref: 0041D6E1

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041D6C9
A, xrefs: 0041D627
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041D6D6

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEvent$ErrorLast
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG$A
API String ID: 3169829505-1326287800
Opcode ID: e89d548d165c6ccd7a082492aa9f76ceb39d4a342e0e30b07f374673c9fb6d41
Instruction ID: 4717a6013c7829877e93234c158fbe75f12066bf988c191e84262ef118b64ff5
Opcode Fuzzy Hash: e89d548d165c6ccd7a082492aa9f76ceb39d4a342e0e30b07f374673c9fb6d41
Instruction Fuzzy Hash: AA412AF1904B86EFC314CF26C881782FBE4BB58704F508A2EE2A957641C378A558CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00415180 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 00415195
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 0041519E
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 004151BD
ResetEvent.KERNEL32(00000000,?,?,00412CA3,?,?,?,?,?,?,?,00433B9C), ref: 004151D1
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 004151DD
ResetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00433B9C), ref: 004151E3
GetLastError.KERNEL32(?,?,?,?,?,?,?,00433B9C), ref: 004151E9

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Event$ErrorLast$CreateReset
String ID:
API String ID: 2684445861-0
Opcode ID: 670938e640ea1e4db209150584b68df53bc7c1080c9c0f0405a21129e5743fbd
Instruction ID: 068eba8924103465b4b96f194371cc6e05a3aa6795ab0b5abca74ce5f4d4681e
Opcode Fuzzy Hash: 670938e640ea1e4db209150584b68df53bc7c1080c9c0f0405a21129e5743fbd
Instruction Fuzzy Hash: E9118431700B01EAE7319B6AEC40BD7B3D89FD4744F60852AE115DA2D4D7B8F8828A2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00002000,?,?,?), ref: 0041E9E8
RegCreateKeyExW.ADVAPI32 ref: 0041EA14
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000004,00000000,00000004), ref: 0041EA36
RegCloseKey.ADVAPI32(00000000,?,00000000,00000000,00000004,00000000,00000004), ref: 0041EA40

Strings

, xrefs: 0041EA2E
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted, xrefs: 0041EA02

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CloseCreateFileModuleNameValue
String ID: $Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
API String ID: 506456306-2837994659
Opcode ID: 9ef6a000b2af350e772483fbf86137953c4e018e4428102ed8f1a798441201ee
Instruction ID: 0e3c631b592d9466001b2de6060d7075d7ffc32f5526a3d9b253da112b9fda37
Opcode Fuzzy Hash: 9ef6a000b2af350e772483fbf86137953c4e018e4428102ed8f1a798441201ee
Instruction Fuzzy Hash: 960152B0754300BFF220DB51DC4AF6A77E8EB48B04F80481DF7889A1C2D6B4A405CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0042314F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 00423161
TlsGetValue.KERNEL32(00000005,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 00423178
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004231C8,00000000,00425571,00439760,00000000,00000314,?,004230A3,00439760,Microsoft Visual C++ Runtime Library,00012010), ref: 0042318E
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004231A9

Strings

KERNEL32.DLL, xrefs: 00423188, 0042318D, 00423198
EncodePointer, xrefs: 004231A3

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 4ef612fe1326c84ec230daf070a95da59f1b4d14b6949d682cecbb7ac4dcd17d
Instruction ID: daa87357a87a1e4e0ef2d1d1bbe15988916afdd93ab62a48e1b9757b7f748a81
Opcode Fuzzy Hash: 4ef612fe1326c84ec230daf070a95da59f1b4d14b6949d682cecbb7ac4dcd17d
Instruction Fuzzy Hash: B2F03670700126BB97205F26FC04ABB3AA99F013523944176FC14D7260DB3CDE62D69C

Uniqueness

Uniqueness Score: -1.00%

Function 004231CA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00423285,?,0042102E), ref: 004231DC
TlsGetValue.KERNEL32(00000005,?,00423285,?,0042102E), ref: 004231F3
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00423285,?,0042102E), ref: 00423209
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00423224

Strings

KERNEL32.DLL, xrefs: 00423203, 00423208, 00423213
DecodePointer, xrefs: 0042321E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 5819036b07a8f835e0a577b12fa298e2b16a2ee1c982b743f9ae82597d1ccb16
Instruction ID: d2b717125cd0513a4a46dcede76b6d967e689a70886e68255a06d37ed6e4950c
Opcode Fuzzy Hash: 5819036b07a8f835e0a577b12fa298e2b16a2ee1c982b743f9ae82597d1ccb16
Instruction Fuzzy Hash: 81F03670704125EB97205F66FD049673EA89F103513944176FC14D7260DB3CDE55D6A9

Uniqueness

Uniqueness Score: -1.00%

Function 004285A6 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042FC04,00000001,?,00000100,?,?,?,?,?,00428790,?,?,?,?,?), ref: 004285D5
GetLastError.KERNEL32(?,00428790,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004285E7
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,?,?,?,?,00428790,?,?,?), ref: 0042864C
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 004286B6
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 004286C4
GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,?,?,?,?,?,00428790,?,?,?,?), ref: 00428739

Part of subcall function 00429633: GetCPInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,00428790,?,?,?,?,?,?), ref: 0042967E
Part of subcall function 00429633: GetCPInfo.KERNEL32(?,00000001,?,00428790,?,?), ref: 00429697
Part of subcall function 00429633: MultiByteToWideChar.KERNEL32(?,00000001,?,00428790,?,00000000,?,?,?,?,?,?,?,00428790,?,?), ref: 00429744
Part of subcall function 00429633: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00428790), ref: 0042975F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Info$ErrorLast
String ID:
API String ID: 2250435928-0
Opcode ID: a7ed2f8b7dec2b9b382c94045e007b3144cc7158194233a777a15d092bd5a497
Instruction ID: 5d771249b7e0fca6b600092783b7d090cf16521b3a94d3bb2ee6a295d965dded
Opcode Fuzzy Hash: a7ed2f8b7dec2b9b382c94045e007b3144cc7158194233a777a15d092bd5a497
Instruction Fuzzy Hash: 5B51AF7170112AAFDF209F64EC819AF3BA9EB04354BA4442EF901C7250DB79DD61CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF80 Relevance: 9.1, APIs: 6, Instructions: 56synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF99
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041BFBB
SendMessageW.USER32(00000000,?,00000000,?), ref: 0041BFD3
CloseHandle.KERNEL32(?), ref: 0041BFDD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BFE9
MessageBoxW.USER32(00000000,?,?,?), ref: 0041C00C

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageObjectSingleWait$CloseCreateEventHandleSend
String ID:
API String ID: 3833482109-0
Opcode ID: 0b788cf7af48f74d30c4f0ea5c33d9a8adc3578a1e0daadd6c1318ae98fe1c94
Instruction ID: f91b4b6455c39529ea0f93616aee9c7d89bd0d9653428511fc5c91251fe49f37
Opcode Fuzzy Hash: 0b788cf7af48f74d30c4f0ea5c33d9a8adc3578a1e0daadd6c1318ae98fe1c94
Instruction Fuzzy Hash: 42110475604301AFD224DF19DC85F5BB7E8EB88B10F108A1DF59693290D670E80ACBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E480 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70memorystringwindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000,00000000,00420153), ref: 0041E4A3
lstrlenW.KERNEL32(00000000), ref: 0041E4B0
LocalAlloc.KERNEL32(00000000,00000040), ref: 0041E4E7

Strings

IDispatch error #%d, xrefs: 0041E516
Unknown error 0x%0lX, xrefs: 0041E52B

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocFormatLocalMessagelstrlen
String ID: IDispatch error #%d$Unknown error 0x%0lX
API String ID: 3952663782-2934499512
Opcode ID: 027266e23a27e927a6ece381ce4c76f82ce2e5e9c148b84658b8c9045bea832f
Instruction ID: 1d15befb501128dd820a01fae309b8b03904db938a5df1f253dafdad90b1e791
Opcode Fuzzy Hash: 027266e23a27e927a6ece381ce4c76f82ce2e5e9c148b84658b8c9045bea832f
Instruction Fuzzy Hash: 2C21A570200221EBE730EB59ED46FE673A6EF54308F604559F5449B2C2F7B9B982C758

Uniqueness

Uniqueness Score: -1.00%

Function 0041CF30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrywindowCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,35A089A6,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF6A
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MODAL_DLG,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF7E
RegisterWindowMessageW.USER32(CDialog::MSG_CREATE_MESSAGE_BOX,?,?,?,?,0042BE78,000000FF,0041CE6F,?), ref: 0041CF88

Strings

CDialog::MSG_CREATE_MODAL_DLG, xrefs: 0041CF76
CDialog::MSG_CREATE_MESSAGE_BOX, xrefs: 0041CF80

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: MessageRegisterWindow$CreateEvent
String ID: CDialog::MSG_CREATE_MESSAGE_BOX$CDialog::MSG_CREATE_MODAL_DLG
API String ID: 2418267205-1515309323
Opcode ID: 7fa1a575ea346de8f28e5e3722ceb1a3217c4de9ee22338078f5ffbbcd47b5eb
Instruction ID: e1c83e00d976b7b479650104844ec0f6e79c37c59f4d0df13700cc8b20bf3eca
Opcode Fuzzy Hash: 7fa1a575ea346de8f28e5e3722ceb1a3217c4de9ee22338078f5ffbbcd47b5eb
Instruction Fuzzy Hash: 58118BB1A04746AFD300CF26C880B12FBE8FB48760F504A2FE55893A80C378B814CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6C0 Relevance: 8.8, APIs: 7, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0041C5A8), ref: 0041B6CE
LeaveCriticalSection.KERNEL32(?,?,?,?,0041C5A8), ref: 0041B6DE
EnterCriticalSection.KERNEL32(?), ref: 0041B6E8
LeaveCriticalSection.KERNEL32(?), ref: 0041B6F2
Sleep.KERNEL32(00000064), ref: 0041B6FD
EnterCriticalSection.KERNEL32(?), ref: 0041B704
LeaveCriticalSection.KERNEL32(?), ref: 0041B70E

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Sleep
String ID:
API String ID: 2348874005-0
Opcode ID: f8c0275f32117be734c0b8a6040b515ae9982e18d29e130f81fb3d05d829968e
Instruction ID: 7d0ab2ec63e2e510b595603aed5c06e49eb38fb67e82f02a5ca42a647926e9c3
Opcode Fuzzy Hash: f8c0275f32117be734c0b8a6040b515ae9982e18d29e130f81fb3d05d829968e
Instruction Fuzzy Hash: 4FF0F96210E3E17DE31197B99C80BEBFFC8AF4A114F48044AF38542642CB64E499D3EE

Uniqueness

Uniqueness Score: -1.00%

Function 00424E1C Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00424E31

Part of subcall function 00423A93: Sleep.KERNEL32(00000000), ref: 00423ABB

GetFileType.KERNEL32(00000040), ref: 00424F5B
GetStdHandle.KERNEL32(-000000F6), ref: 00424FE5
GetFileType.KERNEL32(00000000), ref: 00424FF7
SetHandleCount.KERNEL32 ref: 0042504F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FileHandleType$CountInfoSleepStartup
String ID:
API String ID: 1302456922-0
Opcode ID: b28b26573e01cf66f2cb95df7be044c18b7f1addbcf9981789e44be643f0f182
Instruction ID: b02dce34e118c2087409c128a299b0e4e65301737a26d1de5cc8ce194ba9bc26
Opcode Fuzzy Hash: b28b26573e01cf66f2cb95df7be044c18b7f1addbcf9981789e44be643f0f182
Instruction Fuzzy Hash: D6712771A047618FDB20CF28FD44756BBA0EF85324FAA436AD4619B2E1C77CD842CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00412680 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 0040A930: FindCloseChangeNotification.KERNELBASE(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A973
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A979
Part of subcall function 0040A930: CloseHandle.KERNEL32(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A991
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A997
Part of subcall function 0040A930: CloseHandle.KERNEL32(?,35A089A6,00000000,?,?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B1
Part of subcall function 0040A930: GetLastError.KERNEL32(?,00000000,0042C6E3,000000FF,0041270E), ref: 0040A9B7

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000), ref: 0041271E
GetLastError.KERNEL32 ref: 0041272A
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412740
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00412752
GetLastError.KERNEL32 ref: 0041275F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast$CloseCreateEvent$Handle$ChangeFindNotification
String ID:
API String ID: 213241709-0
Opcode ID: 516182abb57a05b54fca2bc3085f438cd3bdaa9ed7492599c5cdafcbb9abd9f7
Instruction ID: 8ace0b9d7f818b423eaf7a3375f85a0c12461cedc0be4e9cb63852f0f41e943e
Opcode Fuzzy Hash: 516182abb57a05b54fca2bc3085f438cd3bdaa9ed7492599c5cdafcbb9abd9f7
Instruction Fuzzy Hash: DA317A716083009FC720DF1AD984E5BBBF5EBD8710F104A2EF955C7290D7B5A881CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB00 Relevance: 7.6, APIs: 5, Instructions: 79windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041BB19
LeaveCriticalSection.KERNEL32(?), ref: 0041BB22
PostMessageW.USER32(?,00008000,00000000,00000000), ref: 0041BB42
EnterCriticalSection.KERNEL32(?), ref: 0041BB4F
LeaveCriticalSection.KERNEL32(?), ref: 0041BB72

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$MessagePost
String ID:
API String ID: 1950312729-0
Opcode ID: e829717b7742392a5d7cac33a0f9957d49dedec6ac4da5b3686c1d9b361c6041
Instruction ID: d581ea35383060334206f5fcdd51a0bd68e0bee2ddb56b36f4aad4860aba5ccc
Opcode Fuzzy Hash: e829717b7742392a5d7cac33a0f9957d49dedec6ac4da5b3686c1d9b361c6041
Instruction Fuzzy Hash: 68219C71244704ABD220EF759C80B6BF7E8EF55B04F04081EF69643B41CB75B84687A9

Uniqueness

Uniqueness Score: -1.00%

Function 00428FC0 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(FFFFFFFE,00000000,00000001,?,00000000,00000000,?,0042483B,00000000,?), ref: 00429008
GetLastError.KERNEL32(?,0042483B,00000000,?), ref: 0042901B
GetConsoleOutputCP.KERNEL32(00000000,00000000,00000001,0042483B,00000005,00000000,00000000,00000000,?,0042483B,00000000,?), ref: 0042903B
WideCharToMultiByte.KERNEL32(00000000,?,0042483B,00000000,?), ref: 00429042
WriteConsoleA.KERNEL32(FFFFFFFE,0042483B,00000000,?,00000000,?,0042483B,00000000,?), ref: 0042905E

Part of subcall function 00429A41: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00428FEB,00000000,?,0042483B,00000000,?), ref: 00429A54

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: e8eccd638461bfd16512a990b982fede7f1ca95f29bca1b26eff07a560fd484d
Instruction ID: 032f664b7e78d83ee315460446b2c8b3da75d7442e7cf4a3b349a9b5828177d7
Opcode Fuzzy Hash: e8eccd638461bfd16512a990b982fede7f1ca95f29bca1b26eff07a560fd484d
Instruction Fuzzy Hash: A921A171A01128ABD7309F61EC499FF3B6DEB05321F8042AAF512C61D0DBB49D45CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00414F10 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00414F26
GetLastError.KERNEL32 ref: 00414F36
SetEvent.KERNEL32(?), ref: 00414F3C
GetLastError.KERNEL32 ref: 00414F46
WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FF), ref: 00414F60

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorEventLast$MultipleObjectsResetWait
String ID:
API String ID: 234195192-0
Opcode ID: c0e4b5393c150b2b1d41074350501775be6a1a9ae23a0de58fb55b33defacd65
Instruction ID: 8f6e04e233e7f0ecea5ba5d329dc9ff630179ca758a6f2b2f67ed5664254b869
Opcode Fuzzy Hash: c0e4b5393c150b2b1d41074350501775be6a1a9ae23a0de58fb55b33defacd65
Instruction Fuzzy Hash: DA017C752003018BD320DF69DC80A67B7E4FBD8711F40892EE994C7390EB75E94ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF20 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF30
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0041BF3A
PostMessageW.USER32(?,?,?,?), ref: 0041BF55
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BF61
CloseHandle.KERNEL32(?), ref: 0041BF67

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventHandleMessagePost
String ID:
API String ID: 1259710111-0
Opcode ID: 806b293743ddfa5fc6b1ad8d583cf7613af39d7d78647ed7c97bbd4295f491a7
Instruction ID: ea334cb5308d7a0064a28a168c68656027542afff3d651ce4ab8b114c3d9b8ee
Opcode Fuzzy Hash: 806b293743ddfa5fc6b1ad8d583cf7613af39d7d78647ed7c97bbd4295f491a7
Instruction Fuzzy Hash: 25F0F475204710ABC230DB59EC44F57B7F8EB88B20F108A19B6A6936D0CAB0F8068B65

Uniqueness

Uniqueness Score: -1.00%

Function 00422C55 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,?,00422C8D,?,?,00420F14,000000FF,0000001E,?,00423A5F,?,00000001,?,?,00421EA7,00000018), ref: 00422C5F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00422C6F

Strings

CorExitProcess, xrefs: 00422C69
mscoree.dll, xrefs: 00422C5A

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 8d755ef4f68e99e22c80ee652a7a60e1673d97e89cb30d31356da889f0fdd12c
Instruction ID: 56a54ba1d69cd86169530cbe38a3a50b3769ef0f80295f856b38201d3892e205
Opcode Fuzzy Hash: 8d755ef4f68e99e22c80ee652a7a60e1673d97e89cb30d31356da889f0fdd12c
Instruction Fuzzy Hash: 38D0C9713402187BAB205BF3BE0DA2A3A5D9981B513D40576B808E6250DAB9D812D96D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6E0 Relevance: 6.5, APIs: 2, Strings: 2, Instructions: 461COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0041C702
LeaveCriticalSection.KERNEL32(?), ref: 0041C713

Strings

@N@, xrefs: 0041C983
PTn, xrefs: 0041CAAE, 0041CBC0

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @N@$PTn
API String ID: 3168844106-2214026116
Opcode ID: 8acf8df9a3d0fdefd6065d42bdf7b300d5136280e86f815acb5728404d03b38b
Instruction ID: 7b22e8e9bfa59ed91af09dfebfb28f908978085d459430ebb598829989cac8c5
Opcode Fuzzy Hash: 8acf8df9a3d0fdefd6065d42bdf7b300d5136280e86f815acb5728404d03b38b
Instruction Fuzzy Hash: 5C02AE716143009BC714EF65D880A9BB3E5BFC8304F40492EF9899B391DB78ED49CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042167D Relevance: 6.4, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 00420EDB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38), ref: 00420F52

GetLastError.KERNEL32(?,00421591,?,00000010), ref: 004217F8
GetLastError.KERNEL32(?,00421591,?,00000010), ref: 00421885

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLast$AllocateHeap
String ID:
API String ID: 4219743298-0
Opcode ID: ad2f8294da4cfab47ba3c68b8891da78d6df11ee59e798cda1fb2d497740a30c
Instruction ID: c5eadacef89ec66f5b0d66aa64011e7b2cb7398047c1b02230397993182e2698
Opcode Fuzzy Hash: ad2f8294da4cfab47ba3c68b8891da78d6df11ee59e798cda1fb2d497740a30c
Instruction Fuzzy Hash: 8F51D671F00235AACB217B76BC4566F7664EFB0394BA1052BF815672B1DB3C8C418A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004086A0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 004086B5
GetLastError.KERNEL32 ref: 004086C1
GetWindowTextW.USER32(?,?,00000001), ref: 004086EB
GetLastError.KERNEL32 ref: 00408717

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorLastTextWindow$Length
String ID:
API String ID: 3440162706-0
Opcode ID: c0ddd3581b0e531c08e679f2064eb4f7fc4116aa240d8e2fe6827b0531aec1fd
Instruction ID: 07fccb4b5a50a5a39ac797d7d7c016af7ded2db5039dfe4e2d7ff4f9233aebd5
Opcode Fuzzy Hash: c0ddd3581b0e531c08e679f2064eb4f7fc4116aa240d8e2fe6827b0531aec1fd
Instruction Fuzzy Hash: 6B11A1752145128BD724DF79E94491B73E5EFD4310711457EE086C7394EB35D8428BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415120 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415132
SetEvent.KERNEL32(?), ref: 00415154
GetLastError.KERNEL32 ref: 0041515A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00415162

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ObjectSingleWait$ErrorEventLast
String ID:
API String ID: 3117263442-0
Opcode ID: 58b0573d5ea3f526ce09629d59f4af3ae64b585e59b04b0ade2fd1c9e074ec63
Instruction ID: feaf804519cf69de200bc99c0c312eed2e15eb9b6703e4fc041637bf795a50c3
Opcode Fuzzy Hash: 58b0573d5ea3f526ce09629d59f4af3ae64b585e59b04b0ade2fd1c9e074ec63
Instruction Fuzzy Hash: E3F0B476604715AFD721DF69DC40AA7B3E8BB89330B104B29E1A183390CB74FC828768

Uniqueness

Uniqueness Score: -1.00%

Function 00412850 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 0041286D
GetLastError.KERNEL32 ref: 00412873
ResetEvent.KERNEL32(?), ref: 0041287D
GetLastError.KERNEL32 ref: 00412883

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: ErrorEventLastReset
String ID:
API String ID: 1621066496-0
Opcode ID: fb3bcf7261792f35598a1087b45479a14e7556373594df7cd1b80a5989da819f
Instruction ID: 8222d6231367c2f95b5b8b75f07a3969ecdbb72d7db14b241ba787fa5bd73eff
Opcode Fuzzy Hash: fb3bcf7261792f35598a1087b45479a14e7556373594df7cd1b80a5989da819f
Instruction Fuzzy Hash: A9F05E76600315CF8730AFAADD80457B7E8EF88651301497AD945CB211D7B1E9929BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042346D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0042350B

Part of subcall function 00420DFE: RtlFreeHeap.NTDLL(00000000,?,00433738,0000000C,00423444,00000000,?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C), ref: 00420E66
Part of subcall function 00420DFE: GetLastError.KERNEL32(?,00423A5F,?,00000001,?,?,00421EA7,00000018,00433800,0000000C,00421F38,?,?,?,004234FE,0000000D), ref: 00420E77

Strings

(uC, xrefs: 00423515
@tC, xrefs: 00423555

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: DecrementErrorFreeHeapInterlockedLast
String ID: (uC$@tC
API String ID: 1804986901-3738046239
Opcode ID: e4c095f24c54c999a592f3d2be42f5a1a21264a0fd11f5438d8ef94960603676
Instruction ID: c493a851d32146709216096e48ecb5422a5843256acaa14a0763021ed7ea294d
Opcode Fuzzy Hash: e4c095f24c54c999a592f3d2be42f5a1a21264a0fd11f5438d8ef94960603676
Instruction Fuzzy Hash: 88214D6274572076D624BEBAB549B1B63F99B04769B94840FF04897682CE7CFAC0851C

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,00000004,35A089A6,00000000,?, /m="), ref: 0041AEF0
LocalFree.KERNEL32(?), ref: 0041AF0A

Strings

/m=", xrefs: 0041AE9F

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: /m="
API String ID: 1427518018-3487320
Opcode ID: 695fc31bdaacbd9ee0ee099f19c2e04b9b79b9a2f59bf99be6fb8de6d3772c06
Instruction ID: 0f6c590e0b8d9d0c3bb6e6ee73bddb7d9bdabd2836573f11952a495bd2579edb
Opcode Fuzzy Hash: 695fc31bdaacbd9ee0ee099f19c2e04b9b79b9a2f59bf99be6fb8de6d3772c06
Instruction Fuzzy Hash: A11148B2208340AFD210CF0AD944F5BFBE8EBC8B50F004A2EF18593290C374A805CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00425E89 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 00425EE2
InterlockedIncrement.KERNEL32(02301680), ref: 00425F0D

Strings

(uC, xrefs: 00425EEC

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: (uC
API String ID: 2172605799-1954698195
Opcode ID: 53b6455aa11515e4d592943908821254474665f41ed4d2ddcc9aa7fdd670bcc6
Instruction ID: 2ef626678910c1dd51139d3e05b6160cda8dcc3cebfc1a95911fe8bb1d646cc3
Opcode Fuzzy Hash: 53b6455aa11515e4d592943908821254474665f41ed4d2ddcc9aa7fdd670bcc6
Instruction Fuzzy Hash: ED01C271B05A32A7D731AB69B40975A7760BF04711F82401BE40067680CB7C6A418BCD

Uniqueness

Uniqueness Score: -1.00%

Function 00422296 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,-00000010,00000000,00000000,004227F6,00000000,?,00000000), ref: 004222BD
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,004227F6,00000000,?,00000000), ref: 004222F3
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0042230D
HeapFree.KERNEL32(00000000,?), ref: 00422324

Memory Dump Source

Source File: 00000003.00000002.168294392516.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.168294339811.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294479770.000000000042E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294540667.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.168294602921.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8ue90oYkrv.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 0c870cc8a4655f21a06016b126539c81d98b0a1c08310027ef35540e53e620a5
Instruction ID: 80f46e53f3d67063a77e077d9957d308fce32a10db66055f6894e7dc000a9253
Opcode Fuzzy Hash: 0c870cc8a4655f21a06016b126539c81d98b0a1c08310027ef35540e53e620a5
Instruction Fuzzy Hash: 01118C36A00710EFC3218F25FD05927BBB5FB497207555ABAF592D32B0D3B0AC519B28

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TDService.exePID: 5868, Parent PID: 3760COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1%
Total number of Nodes:	925
Total number of Limit Nodes:	50

Executed Functions

Function 6DA2AE70 Relevance: 20.6, APIs: 1, Strings: 10, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 6DA307D0: CharUpperW.USER32(?,00000000,?,6DA2FCF3,?,6DA2FE6C,?,00000000,?,00000010,E65594C9,?,00000000,00000000), ref: 6DA307F7
Part of subcall function 6DA307D0: CharUpperW.USER32(?,?,6DA2FE6C,?,00000000,?,00000010,E65594C9,?,00000000,00000000), ref: 6DA30804

VariantClear.OLEAUT32(?), ref: 6DA2BEEE

Strings

rar, xrefs: 6DA2B8F8
udf, xrefs: 6DA2BA33
a, xrefs: 6DA2B895
R, xrefs: 6DA2B891
exe, xrefs: 6DA2B192
iso, xrefs: 6DA2B996
Unknown error, xrefs: 6DA2BEB2, 6DA2BEB7
r, xrefs: 6DA2B899
001, xrefs: 6DA2B76A
!, xrefs: 6DA2B89D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CharUpper$ClearVariant
String ID: !$001$R$Unknown error$a$exe$iso$r$rar$udf
API String ID: 3047578428-2136912355
Opcode ID: 7a95bdd45440f971f72b94eb5c6f1d525d8374f7118596e1a6bfe986b1d043eb
Instruction ID: 5d04957d26b65d461232a219d0b9f74fb668a4cfb1b589b1f016145641c2248d
Opcode Fuzzy Hash: 7a95bdd45440f971f72b94eb5c6f1d525d8374f7118596e1a6bfe986b1d043eb
Instruction Fuzzy Hash: DAC26A759082298FCB24DF29CD80BEAB7B1BF49304F1885D9D949A7254DB31AEC1CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA335F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6DA337C4
GetLastError.KERNEL32(?), ref: 6DA337D1

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: e586eaacb4335aa4f61ccb1a5f99361bf3fbaa63115484094c8ce81ff57afa73
Instruction ID: 0569e2228463bc6ff02d928e2ecebead2d05793bbaed3da2ad93fd67c4b769a4
Opcode Fuzzy Hash: e586eaacb4335aa4f61ccb1a5f99361bf3fbaa63115484094c8ce81ff57afa73
Instruction Fuzzy Hash: EA82BF7160C3418FD724CF58C580BABB7E6AF89318F158A1DFA8997380D775E885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DA42A30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6DA42B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6DA42B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6DA42B48
FindResourceW.KERNEL32(6DA20000,00000068,RC_DATA), ref: 6DA42B7E
LoadLibraryW.KERNEL32(?,?), ref: 6DA42BA7

Strings

7z.dll, xrefs: 6DA42AAC
RC_DATA, xrefs: 6DA42B76

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource
String ID: 7z.dll$RC_DATA
API String ID: 2112305928-3209790242
Opcode ID: 74aab0ac8a4e183f9a1a40951142efe49283865248ab19e48244bbf35a1f4ce4
Instruction ID: ba39ecd8228c410fdd1ad8431884eaea5e1cb643f2291537d2dd894a43f5d2f9
Opcode Fuzzy Hash: 74aab0ac8a4e183f9a1a40951142efe49283865248ab19e48244bbf35a1f4ce4
Instruction Fuzzy Hash: 2241B37150C3409FC710DF24C944B6BB7E8BB89318F058A6DF69997281DB35E589CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6DA42980 Relevance: 10.6, APIs: 7, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadResource.KERNEL32(6DA20000,00000000,6DA20000,?,?,6DA42B94,?), ref: 6DA42993
SizeofResource.KERNEL32(6DA20000,00000000), ref: 6DA429A1
LockResource.KERNEL32(00000000), ref: 6DA429AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6DA429CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6DA429E5
FindCloseChangeNotification.KERNEL32(00000000), ref: 6DA429FA
DeleteFileW.KERNEL32(00000000), ref: 6DA42A0A

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: FileResource$ChangeCloseCreateDeleteFindLoadLockNotificationSizeofWrite
String ID:
API String ID: 290882627-0
Opcode ID: e1e27d7db632a259ba43113a07f9bb61861633439fe58704eb54347c677968bb
Instruction ID: 0dca45d2d1413e4e7c6672222212951167b14275f1da166f84b8baef7cccac3c
Opcode Fuzzy Hash: e1e27d7db632a259ba43113a07f9bb61861633439fe58704eb54347c677968bb
Instruction Fuzzy Hash: 361129357493057BD7208A689C48FABBB7C9B8A721F04C675FE80E7281D771C84686A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA28AB0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6DA28BF9
FindClose.KERNEL32(FFFFFFFF,?), ref: 6DA28EA0

Part of subcall function 6DA4663B: RaiseException.KERNEL32(?,6DA40629,E65594C9,?,?,6DA40629,?,6DA58388,E65594C9), ref: 6DA4667D

Strings

rar, xrefs: 6DA290BC
001, xrefs: 6DA29003

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CloseFind$ExceptionRaise
String ID: 001$rar
API String ID: 1045303971-402399766
Opcode ID: ad087c47e6ca818636f1fb7956d94008b500f0887445e112c81d3cade61efebb
Instruction ID: 248764ef6251ed749bfd084d61e4901b3cce9eb6e3ca16393959c792db6febb3
Opcode Fuzzy Hash: ad087c47e6ca818636f1fb7956d94008b500f0887445e112c81d3cade61efebb
Instruction Fuzzy Hash: 4F9227B550C3819FC324DF69C580AABB7F5BF88304F588A2DE69987351D731E885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DA32470 Relevance: 4.6, APIs: 3, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(?,E65594C9,6DA50658,00000000), ref: 6DA324C4
FindFirstFileW.KERNEL32(6DA550B8,?,E65594C9,6DA50658,00000000), ref: 6DA324DE
FindFirstFileW.KERNEL32(?,?), ref: 6DA3253A

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: d40b31fedd4a9d0720e530613e0d961ded021317d9500f6933bd948929d026a9
Instruction ID: 95fcb3893a089d91974735eea33eeb62ef7329f9f138dfa04fdac5c755294063
Opcode Fuzzy Hash: d40b31fedd4a9d0720e530613e0d961ded021317d9500f6933bd948929d026a9
Instruction Fuzzy Hash: F431617550C3528FCB10DF28C84576AB7E4FB49328F154B19E4A5C32C0E734AA46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DA34C00 Relevance: 2.1, APIs: 1, Instructions: 589COMMON

Download Yara Rule

APIs

Part of subcall function 6DA32470: FindClose.KERNEL32(?,E65594C9,6DA50658,00000000), ref: 6DA324C4
Part of subcall function 6DA32470: FindFirstFileW.KERNEL32(6DA550B8,?,E65594C9,6DA50658,00000000), ref: 6DA324DE
Part of subcall function 6DA32470: FindFirstFileW.KERNEL32(?,?), ref: 6DA3253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6DA34CE0

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 34d91249e001992869dd39903cc7fd06332e55bb077488a6f084192bc5fdae7a
Instruction ID: 04456e7ef5c6b94575b7c6f75e01420b5d4f9547d64794f506da9ccf0fd55873
Opcode Fuzzy Hash: 34d91249e001992869dd39903cc7fd06332e55bb077488a6f084192bc5fdae7a
Instruction Fuzzy Hash: 9C3269B150C3818FC324CF69C580AABB7E5BFC8314F158A2EE69983350D771E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DA242E0 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharUpperW.USER32(?), ref: 6DA24943

Part of subcall function 6DA4663B: RaiseException.KERNEL32(?,6DA40629,E65594C9,?,?,6DA40629,?,6DA58388,E65594C9), ref: 6DA4667D

Strings

Cannot use absolute pathnames for this command, xrefs: 6DA24521
Incorrect command line, xrefs: 6DA2431B, 6DA2433E, 6DA2454F, 6DA24579, 6DA248F9

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CharExceptionRaiseUpper
String ID: Cannot use absolute pathnames for this command$Incorrect command line
API String ID: 1023082840-724315024
Opcode ID: ef2f8ea9624b078fc95c00dd2e23580ba9442575980f0f80ffe3710e5ad9f603
Instruction ID: 644ae55fb1cdc6dd1d8f36532de3bdcce971b98177f92e0be40540a4d2c8069e
Opcode Fuzzy Hash: ef2f8ea9624b078fc95c00dd2e23580ba9442575980f0f80ffe3710e5ad9f603
Instruction Fuzzy Hash: 1322A17550C3819FD701CF25C580BA6BBE1AF99308F0C899CE5D94B392C7B5E985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA32A70 Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,E65594C9,?,00000000,?,?,00000000,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA32A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,E65594C9,?,00000000,?,?,00000000), ref: 6DA32ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6DA32B2B

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: 811af71502670fe4802ff358088fe2de3ca428d6f8628314b14b8d28d7baec5e
Instruction ID: 50ed08996ac1e8a2c146894edd7422ac85c8fa1b46ea1e68377ab763bd872c91
Opcode Fuzzy Hash: 811af71502670fe4802ff358088fe2de3ca428d6f8628314b14b8d28d7baec5e
Instruction Fuzzy Hash: E831AF75A0821AAFDB10CF54D845BABBBB8FB45720F108719F925972C0D730AA51CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA31340 Relevance: 4.6, APIs: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,E65594C9,?,?,?,?,?,00000000), ref: 6DA3136E
GetLastError.KERNEL32 ref: 6DA3138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 6DA313D7

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: e4ab1d7fc6256fec292d0175d81fa35d2c4a533a57b54fc7edfa623ab597f17d
Instruction ID: 6c36115215bfc37a3a8373afe472873f3756896ee011247b92238ef07d1e39b8
Opcode Fuzzy Hash: e4ab1d7fc6256fec292d0175d81fa35d2c4a533a57b54fc7edfa623ab597f17d
Instruction Fuzzy Hash: 9021F177E0C2149BDB009F99D8017BFFBB9EB45624F01026AEA04D3680DB366945C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA21AB0 Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 6DA21AEC
GetLastError.KERNEL32 ref: 6DA21B01

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 97d8b1ef3c7283a171784063067d8377f7e897477c71274b92fde15f82c2b61c
Instruction ID: 3020a54d74db765d2a76b64d618d0013261c0b662b9bb429a1885055ef682bad
Opcode Fuzzy Hash: 97d8b1ef3c7283a171784063067d8377f7e897477c71274b92fde15f82c2b61c
Instruction Fuzzy Hash: D711D37A70920A4B8700CE6EEC419BBB7E8EB85321F18862EFD14C7250E333D85597E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA28670 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6DA28916

Strings

<H, xrefs: 6DA2896F

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorLast
String ID: <H
API String ID: 1452528299-4022674625
Opcode ID: bbe5350a1772868404354485661e2fb58b44effb4c394174ceaef3e6c045cd5e
Instruction ID: c6a71f88f2533fd981a63d554aefe7c78be0c4c5c983a922bdd2ec952c4cd5f3
Opcode Fuzzy Hash: bbe5350a1772868404354485661e2fb58b44effb4c394174ceaef3e6c045cd5e
Instruction Fuzzy Hash: C9E1B5B5D08249DFCB04DFE8C980AEEBBB5FF48314F18815DE515AB244D734AA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA46360 Relevance: 3.1, APIs: 2, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6DA493E1: HeapCreate.KERNEL32(00000000,00001000,00000000,?,6DA46375,00000001,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9), ref: 6DA493F6

GetCommandLineA.KERNEL32(?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA46396

Part of subcall function 6DA4A76A: GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6DA4A788
Part of subcall function 6DA4A76A: GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6DA4A7C3

Part of subcall function 6DA47C8C: GetStartupInfoA.KERNEL32(?), ref: 6DA47CA1
Part of subcall function 6DA47C8C: GetFileType.KERNEL32(00000040,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47DCB

Part of subcall function 6DA4711E: TlsFree.KERNEL32(00000015,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47149
Part of subcall function 6DA4711E: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA480C0
Part of subcall function 6DA4711E: DeleteCriticalSection.KERNEL32(00000015,?,?,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA480EA

Part of subcall function 6DA470EA: TlsGetValue.KERNEL32(6DA2FA7E,6DA47259,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF,?,6DA2FA7E,?), ref: 6DA470F3
Part of subcall function 6DA470EA: TlsSetValue.KERNEL32(00000000,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF,?,6DA2FA7E,?), ref: 6DA47114

Part of subcall function 6DA47653: Sleep.KERNEL32(00000000,?,6DA2FA7E,?), ref: 6DA4767B

GetCurrentThreadId.KERNEL32 ref: 6DA46466

Part of subcall function 6DA45FF4: HeapFree.KERNEL32(00000000,6DA2FA7E,6DA57EB0,0000000C,6DA481B5,00000000,6DA58028,0000000C,6DA481EF,6DA2FA7E,?,?,6DA4C6AB,00000004,6DA582E8,0000000C), ref: 6DA4605C
Part of subcall function 6DA45FF4: GetLastError.KERNEL32(?,6DA4C6AB,00000004,6DA582E8,0000000C,6DA47669,6DA2FA7E,?,00000000,00000000,00000000,?,6DA4726D,00000001,00000214), ref: 6DA4606D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CriticalDeleteEnvironmentFreeHeapSectionStringsValue$CommandCreateCurrentErrorFileInfoLastLineSleepStartupThreadType
String ID:
API String ID: 3748246414-0
Opcode ID: e365a8271a58cf5979630118b05d695ea38e027856a8ed5bc1f0b9371f830701
Instruction ID: be7057813ffea7452733a36d48ae80cf431feb5a8d6ed1ca317536e51118c32b
Opcode Fuzzy Hash: e365a8271a58cf5979630118b05d695ea38e027856a8ed5bc1f0b9371f830701
Instruction Fuzzy Hash: 6921F83984C3C3969B1167B58B10BDA36B4EF4276D72DC52AD650C2241EF34D0C285F2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA31060 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,E65594C9,?,00000000,?,?,00000000,?,E65594C9,00000000), ref: 6DA3108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 6DA310ED

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7b0b04332256f9a32a3aa8f171d33815626814423332fc0b5375a7ccd5bad0b1
Instruction ID: c8f583c06d9b459778d0919517f319b637bdbfaebbbaa5357a097cfa072f5808
Opcode Fuzzy Hash: 7b0b04332256f9a32a3aa8f171d33815626814423332fc0b5375a7ccd5bad0b1
Instruction Fuzzy Hash: BE21C777E082089BDF00CF95D905BEEF7B8EB85624F05416AE918D3340EB35A545C791

Uniqueness

Uniqueness Score: -1.00%

Function 6DA21C20 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6DA21C4C
GetLastError.KERNEL32 ref: 6DA21C75

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 401af5439d8d8c236de9a60408210452ece14f153793576c7821d65d0cd2c451
Instruction ID: 06fd239437e72eafec11869b059cc4647ed5d9aec9830b91aebabfc08333e92d
Opcode Fuzzy Hash: 401af5439d8d8c236de9a60408210452ece14f153793576c7821d65d0cd2c451
Instruction Fuzzy Hash: 5A01623A20830B9BD750CF59D840BB737F8BF44710F08892AF956CB580D376E8619BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA219C0 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6DA219EB
GetLastError.KERNEL32 ref: 6DA21A0C

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 8b4e956b4c275ddc732695a7053a9fd7d1f361aa25fc1279a3e43a9afb1970b2
Instruction ID: 04db20bb2b9052eb85ac43441668efba4b14b256f927fe656080cc8a0cfda6de
Opcode Fuzzy Hash: 8b4e956b4c275ddc732695a7053a9fd7d1f361aa25fc1279a3e43a9afb1970b2
Instruction Fuzzy Hash: DDF0AF7531830B9BDB00CE55D804B7733A9BB84310F08C92AF84ACB280D776D8619B60

Uniqueness

Uniqueness Score: -1.00%

Function 6DA21BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,6DA3B356,?,?,?,?,?,?,6DA55380,?), ref: 6DA21BE9
GetLastError.KERNEL32(?,?,?,?,?,?,6DA55380,?), ref: 6DA21BFD

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 9ea5b07d23f929034666ee4c8c8c4df99d8d297a98cdc3f6405f98279e4b081d
Instruction ID: e4cf9916f9195950a262fff3b72320514a342fd8737a01f66765595354d008c8
Opcode Fuzzy Hash: 9ea5b07d23f929034666ee4c8c8c4df99d8d297a98cdc3f6405f98279e4b081d
Instruction Fuzzy Hash: 2FE0127C3587035BDB104B36CC4433275B46F41731B98CB28E076C54E0E72FC4828A04

Uniqueness

Uniqueness Score: -1.00%

Function 6DA27350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,E65594C9,?,?,?,?,?,6DA50300,000000FF), ref: 6DA27438

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 1fc9136b10dcdbe2075ae2cd28c993eec9ab294e489ca1573911c22b0ffbc4b0
Instruction ID: d3590e625def4ef7b76c13b577db1d771e8ef322d61d826cdbadb7408f34489e
Opcode Fuzzy Hash: 1fc9136b10dcdbe2075ae2cd28c993eec9ab294e489ca1573911c22b0ffbc4b0
Instruction Fuzzy Hash: 8D5190B5A08A83AFD709CF76C480BA5FBA0FB49314F18866DD46D87601D731B9A5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DA45F2A Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6DA2FA6F,?,00000000,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF), ref: 6DA45FA1

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9f5f409e9892009f1818a8e258d569d434c55850993ef942ec8f6858a7fe9de0
Instruction ID: afb61a7b13f4af7d386cd8984a945ee95b6320465e5f22687fc664855f7c9aed
Opcode Fuzzy Hash: 9f5f409e9892009f1818a8e258d569d434c55850993ef942ec8f6858a7fe9de0
Instruction Fuzzy Hash: 2511B63654F7226AD7011A68CD00B7A67A8AF02768F1AC125E910DB9D0DB71DCC1C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA31420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6DA2890F,E65594C9,?,?,00000000), ref: 6DA31528

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7feafbba8643845e4e94324984d7c0487b471d1d4ea24d6648fc13be76672710
Instruction ID: d87f9ea020b62057bc3dffbbceee09397e68a9b939a0ac648b81e30352e60f8a
Opcode Fuzzy Hash: 7feafbba8643845e4e94324984d7c0487b471d1d4ea24d6648fc13be76672710
Instruction Fuzzy Hash: 2BB10776E0C2198BCF04CFA8DA81AFEB3B6FF44304F198129D905E7240E735A995CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA325A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6DA32470: FindClose.KERNEL32(?,E65594C9,6DA50658,00000000), ref: 6DA324C4
Part of subcall function 6DA32470: FindFirstFileW.KERNEL32(6DA550B8,?,E65594C9,6DA50658,00000000), ref: 6DA324DE
Part of subcall function 6DA32470: FindFirstFileW.KERNEL32(?,?), ref: 6DA3253A

FindClose.KERNEL32(FFFFFFFF,?,E65594C9,?,00000000,6DA550B8,?,6DA50438,000000FF,?,6DA3265E), ref: 6DA325EA

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 614f9ad3bdfedfe3dade58098ad10ca6ede8e78f50564f0deea1981bb22dc867
Instruction ID: 4cbabad04d890af42ad636271385634658481b03fb75f368f750d59ce70691f3
Opcode Fuzzy Hash: 614f9ad3bdfedfe3dade58098ad10ca6ede8e78f50564f0deea1981bb22dc867
Instruction Fuzzy Hash: 67F06DB6908608AFCB10CF98C840BAEB7B8FB46624F50471AF831D33C0D73469058AA4

Uniqueness

Uniqueness Score: -1.00%

Function 6DA21950 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 6DA2196C

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b0aa01db340073fd59d849ebb0ceec2667679b173dde001344ce94e5a475b32b
Instruction ID: d3c649870d1314a53a0669028ab2328cfb30706725e40dd6c6fd64f1cd030fa0
Opcode Fuzzy Hash: b0aa01db340073fd59d849ebb0ceec2667679b173dde001344ce94e5a475b32b
Instruction Fuzzy Hash: E3E0DFB120C70517C3109E6A9808B6BBBD89F02370B18CB29E9B9C76C0D3B2D4A2C791

Uniqueness

Uniqueness Score: -1.00%

Function 6DA493E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6DA46375,00000001,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9), ref: 6DA493F6

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 93a76d93a45eba62d808b382f6afec1a6ede16aac2180255f2d81304b904d2c6
Instruction ID: 807b3513c76f15a46b23746c1907b61dd5dd14b5fb37c3a41b966ec31c3bf02f
Opcode Fuzzy Hash: 93a76d93a45eba62d808b382f6afec1a6ede16aac2180255f2d81304b904d2c6
Instruction Fuzzy Hash: 14D05E3659C3499ADF005EB59D08B223BECA786399F04C439F90CC6180F770C5528600

Uniqueness

Uniqueness Score: -1.00%

Function 6DA2CAE0 Relevance: 1.5, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 6DA45F2A: RtlAllocateHeap.NTDLL(00000000,6DA2FA6F,?,00000000,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF), ref: 6DA45FA1

GetLastError.KERNEL32(?,00000000,00000000), ref: 6DA2CBD3

Part of subcall function 6DA4663B: RaiseException.KERNEL32(?,6DA40629,E65594C9,?,?,6DA40629,?,6DA58388,E65594C9), ref: 6DA4667D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 3847173015-0
Opcode ID: b145391b6300cf8d59903d082c3e9c3b79f23b96ca5aa9e57825ca71a7df2eb2
Instruction ID: 364d53bba09623cf84c48372349a63043c7289d5382d57ff8669b6dfc3217a03
Opcode Fuzzy Hash: b145391b6300cf8d59903d082c3e9c3b79f23b96ca5aa9e57825ca71a7df2eb2
Instruction Fuzzy Hash: D2A1A8B1D08209EFCB04DFA8D980AEEB7B4FF48314F158129E915A7340D735EA55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA2C2D0 Relevance: 1.4, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6DA54C28,80000000,00000001,00000003), ref: 6DA2C3BC

Part of subcall function 6DA45F2A: RtlAllocateHeap.NTDLL(00000000,6DA2FA6F,?,00000000,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF), ref: 6DA45FA1

Part of subcall function 6DA4663B: RaiseException.KERNEL32(?,6DA40629,E65594C9,?,?,6DA40629,?,6DA58388,E65594C9), ref: 6DA4667D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 3847173015-0
Opcode ID: 6d5d17f4e6418863c88ac87b19f0cf682a01473ae488b1cb131267737dc7cb7f
Instruction ID: 764103cddad89c98332681e5b6078cf398c474fe5e171cc4ba403af266e9ab28
Opcode Fuzzy Hash: 6d5d17f4e6418863c88ac87b19f0cf682a01473ae488b1cb131267737dc7cb7f
Instruction Fuzzy Hash: BD41D271608205AFCB10CFA9C980BAAF7A9BF49320F158659EA5597380C774EA46CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DA45A8A Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 6DA45B66
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 6DA45B70
UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 6DA45B7D
GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 6DA45B98
TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 6DA45B9F

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c6bb19caac027aac8ecd011b85bc1ccd0ed5a3c721cde1e0f06de765a9990b82
Instruction ID: 6c6b649ffc442f07e83a4db59b34b139065bbd1b1b434b303747e1533ca94083
Opcode Fuzzy Hash: c6bb19caac027aac8ecd011b85bc1ccd0ed5a3c721cde1e0f06de765a9990b82
Instruction Fuzzy Hash: E031E2B4D053299BCF20DF64D9897C8BBB8BF58308F1081EAA50CA6250EB745FC58F48

Uniqueness

Uniqueness Score: -1.00%

Function 6DA451C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6DA46B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6DA46BA6
UnhandledExceptionFilter.KERNEL32(6DA53328), ref: 6DA46BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 6DA46BCD
TerminateProcess.KERNEL32(00000000), ref: 6DA46BD4

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8c3c5f28393b7424e1643ec0fc7d9a780079d8dc686e6b7a8d3479aab20934c3
Instruction ID: 5c8905281bcfcb32913d1d4fcbf244d98038949c626bf4a3ac44039873eb8968
Opcode Fuzzy Hash: 8c3c5f28393b7424e1643ec0fc7d9a780079d8dc686e6b7a8d3479aab20934c3
Instruction Fuzzy Hash: D52198B881D305DFDF01DF28D188B883BB4BB4A324F51C15EEA0987281EBB45986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6DA22AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6DA22BB4
GetLastError.KERNEL32 ref: 6DA22BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6DA22BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 6DA22C88
CloseHandle.KERNEL32(?), ref: 6DA22C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 6DA22CA8
GetLastError.KERNEL32 ref: 6DA22CBD
SetEvent.KERNEL32(00000000), ref: 6DA22CC4
GetLastError.KERNEL32 ref: 6DA22CCE
CloseHandle.KERNEL32(00000000), ref: 6DA22CD5
GetLastError.KERNEL32 ref: 6DA22CDF

Strings

Can not open mapping, xrefs: 6DA22BCD
MapViewOfFile error, xrefs: 6DA22BEE
Incorrect command line, xrefs: 6DA22B13, 6DA22B63
data error, xrefs: 6DA22C6A
Incorrect mapping data, xrefs: 6DA22C02

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$MappingUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 1601163770-464465891
Opcode ID: 955662b1857dc71c27726f2e64ce6441f9db42fdee964495971f824d10c04cfc
Instruction ID: 6f7a4a397f39e57b13e636806c4ec9fda68deba0917409121da5bbd656ab0f84
Opcode Fuzzy Hash: 955662b1857dc71c27726f2e64ce6441f9db42fdee964495971f824d10c04cfc
Instruction Fuzzy Hash: 8B61F775A1C30A9BDB10DFAACD40BAEB7B4EF45758F198124E904AB240D770E985C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA47472 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,6DA46386,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA4747C
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6DA474A3
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6DA474B0
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6DA474BD
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6DA474CA
TlsAlloc.KERNEL32(?,?,6DA46386,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA4751A
TlsSetValue.KERNEL32(00000000,?,?,6DA46386,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47535
GetCurrentThreadId.KERNEL32 ref: 6DA475E4

Part of subcall function 6DA47790: Sleep.KERNEL32(000003E8,?,?,6DA470BE,KERNEL32.DLL,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?), ref: 6DA4779C
Part of subcall function 6DA47790: GetModuleHandleW.KERNEL32(6DA2FA7E,?,6DA470BE,KERNEL32.DLL,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?,?), ref: 6DA477A5

Part of subcall function 6DA4711E: TlsFree.KERNEL32(00000015,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47149
Part of subcall function 6DA4711E: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA480C0
Part of subcall function 6DA4711E: DeleteCriticalSection.KERNEL32(00000015,?,?,6DA4641B,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA480EA

Strings

FlsSetValue, xrefs: 6DA474B2
KERNEL32.DLL, xrefs: 6DA47476, 6DA4747B, 6DA47486
FlsFree, xrefs: 6DA474BF
FlsGetValue, xrefs: 6DA474A5
FlsAlloc, xrefs: 6DA4749D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressProc$CriticalDeleteHandleModuleSection$AllocCurrentFreeSleepThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3695068788-3819984048
Opcode ID: 132c92fb5367f0aa33fa8880d24e666915a9e5d6d9bb35a33fc26ce99c677378
Instruction ID: a4cf1c9f81fb23c0d3c7da431c0660ad484555d0297d42408b4011fbd9c391ba
Opcode Fuzzy Hash: 132c92fb5367f0aa33fa8880d24e666915a9e5d6d9bb35a33fc26ce99c677378
Instruction Fuzzy Hash: D6315B75C0D343AADF119F359908B263AF4EB4B364B15C52EF560E7290EB35C093CA95

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4D750 Relevance: 16.8, APIs: 11, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,6DA54BBC,00000001,00000000,00000000,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6DA4D782
GetLastError.KERNEL32 ref: 6DA4D794
MultiByteToWideChar.KERNEL32(00000100,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6DA4D820
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 6DA4D88C
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 6DA4D8A8
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 6DA4D8E2
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 6DA4D946
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 6DA4D969
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000100,?,00000000,?,?,?,?), ref: 6DA4D9F9
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000100,?,00000000,?), ref: 6DA4DA6B
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6DA4DAB8

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 04ff61397bec8ed44549dab8f47e9cc8bc05e0d8604862e5201234f18da270a6
Instruction ID: d79dc6a98e8102f3a0c447b7c15b2b8af820d0bdb4a3aaf9ba76b3c130c5a1f0
Opcode Fuzzy Hash: 04ff61397bec8ed44549dab8f47e9cc8bc05e0d8604862e5201234f18da270a6
Instruction Fuzzy Hash: 9EB18D7680C21AEFDF019FA4CC809AE7BB5FB89314B19C529FA15A7150D331C9E1DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4B89E Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 128libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library), ref: 6DA4B8C6
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 6DA4B8E2

Part of subcall function 6DA46FF4: TlsGetValue.KERNEL32(00000000,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA47006
Part of subcall function 6DA46FF4: TlsGetValue.KERNEL32(00000005,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA4701D

GetProcAddress.KERNEL32(00000000,00000000), ref: 6DA4B8FF

Part of subcall function 6DA46FF4: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA47033
Part of subcall function 6DA46FF4: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6DA4704E

GetProcAddress.KERNEL32(00000000,00000000), ref: 6DA4B914
GetProcAddress.KERNEL32(00000000,00000000), ref: 6DA4B929
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 6DA4B941

Strings

GetProcessWindowStation, xrefs: 6DA4B93B
USER32.DLL, xrefs: 6DA4B8C1
MessageBoxA, xrefs: 6DA4B8DC

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressProc$Value$HandleLibraryLoadModule
String ID: GetProcessWindowStation$MessageBoxA$USER32.DLL
API String ID: 2739679353-2247880650
Opcode ID: cc6c238e33932789184177d9b324983da83870213c8f4eab0b3f0fae24a934f1
Instruction ID: b358aa27a0efdec9b5b73386f7f00684d0160cd591de9485e443e0eca014a2e9
Opcode Fuzzy Hash: cc6c238e33932789184177d9b324983da83870213c8f4eab0b3f0fae24a934f1
Instruction Fuzzy Hash: 1A41C27580D347ABDF109FB4CD0AB6E3BB8AF85354F14C929EA14D2281EB75D4C1CA62

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4A76A Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6DA4A788
GetLastError.KERNEL32(?,?,?), ref: 6DA4A79C
GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6DA4A7C3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?), ref: 6DA4A7FD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?), ref: 6DA4A820
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?), ref: 6DA4A836
GetEnvironmentStrings.KERNEL32(?,?,?), ref: 6DA4A849
FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?), ref: 6DA4A87B
FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?), ref: 6DA4A894

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: f3c605dcfb2a788fe07c6ba671b7d5fdbaaf3814d5ca9be786330fedbe7b1da8
Instruction ID: 370b454615dc7cd44f691a22f1ebba1f0c73113acbd9a10d39dfc7fd454464e9
Opcode Fuzzy Hash: f3c605dcfb2a788fe07c6ba671b7d5fdbaaf3814d5ca9be786330fedbe7b1da8
Instruction Fuzzy Hash: 203187B690C256AEDB116FB84C84D3E7ABEEB8635C729C439E651D3140E7318DC29760

Uniqueness

Uniqueness Score: -1.00%

Function 6DA36530 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 323libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6DA36AD8,GetHandlerProperty2), ref: 6DA36584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6DA36595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6DA365B1

Strings

GetHandlerProperty, xrefs: 6DA3658F
GetNumberOfFormats, xrefs: 6DA365AB
GetHandlerProperty2, xrefs: 6DA36579

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats
API String ID: 190572456-3564775856
Opcode ID: 71cb4b5964f118a9cfe4cefc7d0ce79f1015169f74d90c2d68a79440d465ccfe
Instruction ID: 43a9171f0ba636fef1c6725324074e4b9359b55144cd627b97f6240b9ef216d2
Opcode Fuzzy Hash: 71cb4b5964f118a9cfe4cefc7d0ce79f1015169f74d90c2d68a79440d465ccfe
Instruction Fuzzy Hash: 22D15EB1D082289FDB14DFA9CD80BAEB7B5BF49304F1581ADE519E7240D7309A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA46E10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,6DA5F429,00000104,?,6DA2FA7E,?), ref: 6DA46EB3
GetStdHandle.KERNEL32(000000F4,00000001,?,00000000,00000003,00000003,?,6DA46FE7,000000FC,6DA48132,6DA58028,0000000C,6DA481EF,6DA2FA7E,?), ref: 6DA46F86
WriteFile.KERNEL32(00000000,00000000,00000000,6DA2FA7E,00000000,?,6DA46FE7,000000FC,6DA48132,6DA58028,0000000C,6DA481EF,6DA2FA7E,?,?,6DA4C6AB), ref: 6DA46FB0

Strings

Runtime Error!Program: , xrefs: 6DA46E75
Microsoft Visual C++ Runtime Library, xrefs: 6DA46F74
<program name unknown>, xrefs: 6DA46EBD
..., xrefs: 6DA46F02

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: b4796911b87a198309f9b224d4b793be2d7ee12e875c84c16a5b4070a129503a
Instruction ID: f2272519378d8ee1ea92368627e9b7fd73fb15d10d6e6a1b5a7a8f7ad46f7196
Opcode Fuzzy Hash: b4796911b87a198309f9b224d4b793be2d7ee12e875c84c16a5b4070a129503a
Instruction Fuzzy Hash: AE4139B2A0D3127AEB0556748E85FFF36AC9F42758F1DC624FE44912C1E722CAD181E2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4715B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6DA57F58,0000000C,6DA47296,00000000,00000000,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B), ref: 6DA4716D
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6DA471A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6DA471B1
InterlockedIncrement.KERNEL32(02C08302), ref: 6DA471E0

Part of subcall function 6DA47790: Sleep.KERNEL32(000003E8,?,?,6DA470BE,KERNEL32.DLL,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?), ref: 6DA4779C
Part of subcall function 6DA47790: GetModuleHandleW.KERNEL32(6DA2FA7E,?,6DA470BE,KERNEL32.DLL,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?,?), ref: 6DA477A5

Strings

DecodePointer, xrefs: 6DA471A9
KERNEL32.DLL, xrefs: 6DA47167, 6DA4716C, 6DA47177
EncodePointer, xrefs: 6DA47195

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressHandleModuleProc$IncrementInterlockedSleep
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 3998264955-2843748187
Opcode ID: a02d54ed62e1f6aa669c36d80a2f2eb68577ac897b852db455b4806ab8d7c8ef
Instruction ID: 235914c1c6eee4d7e2170cb75442c6c2f2bbef9f45584d0d7ef2a58488f8f184
Opcode Fuzzy Hash: a02d54ed62e1f6aa669c36d80a2f2eb68577ac897b852db455b4806ab8d7c8ef
Instruction Fuzzy Hash: 9A11AFB180D742EEDB20DF79DA00B5ABBF0AF45314F11C91AE5A993290CB30A991CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4BD53 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000000), ref: 6DA4BD6D
InterlockedDecrement.KERNEL32(?), ref: 6DA4BD7A
InterlockedDecrement.KERNEL32(?), ref: 6DA4BD87
InterlockedDecrement.KERNEL32(?), ref: 6DA4BD94
InterlockedDecrement.KERNEL32(?), ref: 6DA4BDA1
InterlockedDecrement.KERNEL32(?), ref: 6DA4BDBD
InterlockedDecrement.KERNEL32(?), ref: 6DA4BDCD
InterlockedDecrement.KERNEL32(?), ref: 6DA4BDE3

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: DecrementInterlocked
String ID:
API String ID: 3448037634-0
Opcode ID: fe6d9842a5958b4f930e41230d27ab9ace49def89b7d1a0641f3af3901ccf4ff
Instruction ID: 55eb86b344138768bc48a252698a4f1d9e479cd2fe9d2a5baa9204519269f62d
Opcode Fuzzy Hash: fe6d9842a5958b4f930e41230d27ab9ace49def89b7d1a0641f3af3901ccf4ff
Instruction Fuzzy Hash: 4C116536B04716A7EF009F79CC84BAEB7ADBF44640F088656A418D7140DB74E480CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4BCC4 Relevance: 12.1, APIs: 8, Instructions: 58COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(6DA2FA7E), ref: 6DA4BCD6
InterlockedIncrement.KERNEL32(00000D89), ref: 6DA4BCE3
InterlockedIncrement.KERNEL32(E58B5B5E), ref: 6DA4BCF0
InterlockedIncrement.KERNEL32(5F590000), ref: 6DA4BCFD
InterlockedIncrement.KERNEL32(8B55CCCC), ref: 6DA4BD0A
InterlockedIncrement.KERNEL32(8B55CCCC), ref: 6DA4BD26
InterlockedIncrement.KERNEL32(F07589E0), ref: 6DA4BD36
InterlockedIncrement.KERNEL32(A157559F), ref: 6DA4BD4C

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: IncrementInterlocked
String ID:
API String ID: 3508698243-0
Opcode ID: 3ba41490680011e7ac6ce84c095e93289ce972132761b00aba4e02343adb6668
Instruction ID: 5cb5955ea364d9ef4cec93d96a92e28666b29dd7b0d8cec63471c4b22b9e775f
Opcode Fuzzy Hash: 3ba41490680011e7ac6ce84c095e93289ce972132761b00aba4e02343adb6668
Instruction Fuzzy Hash: 09112175B0431AA7EF009F79CD84B6EB7ACFF45244F088566A818D7141DB34E890CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4DF24 Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000001,?,00000000,00000000,?,?,?,?,6DA4D6F0,00000000,?,00000001,?,?,?), ref: 6DA4DF6F
GetCPInfo.KERNEL32(?,00000001,?,6DA4D6F0,00000000,?), ref: 6DA4DF88
MultiByteToWideChar.KERNEL32(?,00000001,?,6DA4D6F0,00000000,00000000,?,6DA4D6F0,00000000,?,00000001,?,?,?,?,00000001), ref: 6DA4DFE6
MultiByteToWideChar.KERNEL32(?,00000001,?,6DA4D6F0,?,00000000,?,?,?,?,?,?,?,6DA4D6F0,00000000,?), ref: 6DA4E035
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6DA4D6F0), ref: 6DA4E050
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6DA4D6F0), ref: 6DA4E076
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6DA4D6F0), ref: 6DA4E09B

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: dd58675405d75a4e8a14623c437dc5d996ba1056a0ecff418c0f23ec9ff945f8
Instruction ID: 174621d4ad155d4d674042f4eeaf02644f15b454b552384939a2a5f6dbac8ffa
Opcode Fuzzy Hash: dd58675405d75a4e8a14623c437dc5d996ba1056a0ecff418c0f23ec9ff945f8
Instruction Fuzzy Hash: 83515D31D0821AAFCF21CF95DC44DEEBBB9FF89754B148119F525E6150D7318981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA46FF4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA47006
TlsGetValue.KERNEL32(00000005,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA4701D
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6DA4706D,00000000,6DA4B8AE,6DA5F410,00000000,00000314,?,6DA46F7F,6DA5F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6DA47033
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6DA4704E

Strings

KERNEL32.DLL, xrefs: 6DA4702D, 6DA47032, 6DA4703D
EncodePointer, xrefs: 6DA47048

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 257c7ca471d70b1108c1345d452943b166de49ddf6595850546dbeccee3791da
Instruction ID: 5cef0fa06049ebb24ab1dcb2cc8a7eaee2a8039591eb29498aaa02f889b55804
Opcode Fuzzy Hash: 257c7ca471d70b1108c1345d452943b166de49ddf6595850546dbeccee3791da
Instruction Fuzzy Hash: E4F04F75A0D75BABDF119A65CC04FAA3AB8EFC2264704C060F828D7190DB35DDA2CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4706F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6DA2FA7E,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?), ref: 6DA47081
TlsGetValue.KERNEL32(00000005,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?), ref: 6DA47098
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6DA494A4,?,6DA45FE3,6DA2FA7E,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?), ref: 6DA470AE
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6DA470C9

Strings

DecodePointer, xrefs: 6DA470C3
KERNEL32.DLL, xrefs: 6DA470A8, 6DA470AD, 6DA470B8

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 65b797d871e1cea218160090fcbd9a8ff7ff27937bf073a9c5325130646bb8c3
Instruction ID: 0bde34414d2f202c0d65c7f7f283956939f68d505bf7a42694c2531781105328
Opcode Fuzzy Hash: 65b797d871e1cea218160090fcbd9a8ff7ff27937bf073a9c5325130646bb8c3
Instruction Fuzzy Hash: 76F04F7590D75BABDF119A25CC04BAA3BA8EFC2260704C024F818D7190DB25D992CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA30450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6DA32A70: CloseHandle.KERNEL32(?,E65594C9,?,00000000,?,?,00000000,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA32A9F
Part of subcall function 6DA32A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,E65594C9,?,00000000,?,?,00000000), ref: 6DA32ACC
Part of subcall function 6DA32A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6DA32B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,E65594C9,?,?,00000000,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA304A7
GetLastError.KERNEL32(?,?,?,00000000,6DA50C38,000000FF), ref: 6DA304B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,E65594C9,?,?,00000000,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA3051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA3053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6DA50C38,000000FF), ref: 6DA3056C

Part of subcall function 6DA30A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,E65594C9,00000000), ref: 6DA30AA7

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6DA306D8

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorLastMultiSizeWide
String ID:
API String ID: 2846089904-0
Opcode ID: c4bb42628b1004041b3aa7561c1c7e346fe00b9f2d028089ac905316fb6ce829
Instruction ID: a7100eb17b43346b0b24fbce99f15a3046d426a7d81a16ead88028a04a0b836f
Opcode Fuzzy Hash: c4bb42628b1004041b3aa7561c1c7e346fe00b9f2d028089ac905316fb6ce829
Instruction Fuzzy Hash: 5E81F372D0C2199BCF00DFA9D940BEEB776EF44324F168219E921F7280EB74A585CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4D506 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,6DA54BBC,00000001,?,00000100,?,?,?,?,?,6DA4D6F0,00000000,?,00000001,?,?), ref: 6DA4D535
GetLastError.KERNEL32(?,6DA4D6F0,00000000,?,00000001,?,?,?,?,00000001,?,00000000,00000001,00000000), ref: 6DA4D547
MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,00000100,?,?,?,?,?,6DA4D6F0,00000000,?,00000001), ref: 6DA4D5AC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 6DA4D616
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6DA4D624
GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,?,?,?,?,?,6DA4D6F0,00000000,?,00000001,?), ref: 6DA4D699

Part of subcall function 6DA4DF24: GetCPInfo.KERNEL32(?,00000001,?,00000000,00000000,?,?,?,?,6DA4D6F0,00000000,?,00000001,?,?,?), ref: 6DA4DF6F
Part of subcall function 6DA4DF24: GetCPInfo.KERNEL32(?,00000001,?,6DA4D6F0,00000000,?), ref: 6DA4DF88
Part of subcall function 6DA4DF24: MultiByteToWideChar.KERNEL32(?,00000001,?,6DA4D6F0,?,00000000,?,?,?,?,?,?,?,6DA4D6F0,00000000,?), ref: 6DA4E035
Part of subcall function 6DA4DF24: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6DA4D6F0), ref: 6DA4E050

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Info$ErrorLast
String ID:
API String ID: 2250435928-0
Opcode ID: 85e6a6015dda1b256ad4e75231d4c0f35c2c67777e014a62338af46510daefde
Instruction ID: 07c5ff5b988850427b09e9700e075dd840f008da777cab3dce141d549e6be518
Opcode Fuzzy Hash: 85e6a6015dda1b256ad4e75231d4c0f35c2c67777e014a62338af46510daefde
Instruction Fuzzy Hash: 4B51BC7550820AAFDF009F68CC80EAF7BB9EB89368B15C429FA14C7150DB71C9E1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA369E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,E65594C9,6DA5FCC8,00000000), ref: 6DA36A18
FreeLibrary.KERNEL32(00000000), ref: 6DA36A38
FreeLibrary.KERNEL32(00000000,E65594C9,6DA5FCC8,00000000), ref: 6DA36A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 6DA36AA5

Strings

CreateObject, xrefs: 6DA36A9D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: 3e31f6be657b3973476bd7237c2f6a41e5a454cf1cfc617d6eab068a147b2bb3
Instruction ID: a397d8c36cd2298e5fb49901a3a8adb01ef14f9d9863fd28b19bcc17251b5eeb
Opcode Fuzzy Hash: 3e31f6be657b3973476bd7237c2f6a41e5a454cf1cfc617d6eab068a147b2bb3
Instruction Fuzzy Hash: A6413C75A08746AFDB00CF65C584BAAB7F5FB89310F15C51AE865CB780D734E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DA47C8C Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 6DA47CA1

Part of subcall function 6DA47653: Sleep.KERNEL32(00000000,?,6DA2FA7E,?), ref: 6DA4767B

GetFileType.KERNEL32(00000040,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47DCB
GetStdHandle.KERNEL32(-000000F6,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47E55
GetFileType.KERNEL32(00000000,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA47E67
SetHandleCount.KERNEL32 ref: 6DA47EBF

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: FileHandleType$CountInfoSleepStartup
String ID:
API String ID: 1302456922-0
Opcode ID: 828392a74f7f1fc4ed6ac37b24aa2a73645f898141d816b791a883de067b1fd9
Instruction ID: f0ee1c94b86d1b7ab2466a21800f59d7ec6755d22743c4e9614c7e2ecf77ce20
Opcode Fuzzy Hash: 828392a74f7f1fc4ed6ac37b24aa2a73645f898141d816b791a883de067b1fd9
Instruction Fuzzy Hash: FB712476D0C7C28EDB118B28C8487267BB0BF46328F29C749D0659B2D1D778D885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4CDE3 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(FFFFFFFE,?,00000001,?,00000000,00000000), ref: 6DA4CE2B
GetLastError.KERNEL32 ref: 6DA4CE3E
GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000083,00000005,00000000,00000000,00000000), ref: 6DA4CE5E
WideCharToMultiByte.KERNEL32(00000000), ref: 6DA4CE65
WriteConsoleA.KERNEL32(FFFFFFFE,00000083,00000000,?,00000000), ref: 6DA4CE81

Part of subcall function 6DA4DC35: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6DA4CE0E,00000000), ref: 6DA4DC48

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: fc156fbf7ff9169ca887518b7408bc588ad2172590c21c5e0935d71b14102e42
Instruction ID: 02e6b5a9ce70959ccb35ee3d42111c284f658a5993287d9d3f96728f1994798e
Opcode Fuzzy Hash: fc156fbf7ff9169ca887518b7408bc588ad2172590c21c5e0935d71b14102e42
Instruction Fuzzy Hash: 47218C7950C319ABDF109B64C809ABB3779FB87720B40C218F92997080DB7496DACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4A8ED Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6DA4A924
GetCurrentProcessId.KERNEL32 ref: 6DA4A930
GetCurrentThreadId.KERNEL32 ref: 6DA4A938
GetTickCount.KERNEL32 ref: 6DA4A940
QueryPerformanceCounter.KERNEL32(?), ref: 6DA4A94C

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 776af389abf6a2d370132c4e647a510cd5572150eb8ee7f36f15d3d16b4c8c92
Instruction ID: a5163005b0e8756246f2edb9bd89c326ba54388caf062bb5deaf824b4aeb688e
Opcode Fuzzy Hash: 776af389abf6a2d370132c4e647a510cd5572150eb8ee7f36f15d3d16b4c8c92
Instruction Fuzzy Hash: 5B11CE36D08324ABDF108BF8C448B9AF7F8FB8E355F828425E851E7240EB70C9418794

Uniqueness

Uniqueness Score: -1.00%

Function 6DA35F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6DA35F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6DA35F9F

Strings

GetNumberOfMethods, xrefs: 6DA35F99
GetMethodProperty, xrefs: 6DA35F77

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: 72b9488846d5ca14ac98d47e5d9a96b967617df2554f79674cfb85de2024e71b
Instruction ID: d507210f82581c6d9dec8d22b39bde9f50a20b72aca70621028bb346e8546ce7
Opcode Fuzzy Hash: 72b9488846d5ca14ac98d47e5d9a96b967617df2554f79674cfb85de2024e71b
Instruction Fuzzy Hash: E5216279E0531AABCB00DF99D9819EEB7BAFF49304B158015E904E7301E771E942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA35BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6DA4FD48,E65594C9,00000000,?,80000001,00000000,6DA4FD48,000000FF,?,6DA35DBD,?,6DA5FCC8), ref: 6DA35C1D

Part of subcall function 6DA32FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6DA35DBD,?,?,6DA35C37,?,6DA35DBD,?,6DA5FCC8,00000000,00000000), ref: 6DA3300E
Part of subcall function 6DA32FE0: RegQueryValueExW.ADVAPI32(6DA35DBD,Path,00000000,6DA35DBD,?,6DA35DBD,?,6DA35DBD,?,6DA5FCC8,00000000,00000000), ref: 6DA3304E

RegCloseKey.ADVAPI32(?,?,6DA35DBD,?,6DA5FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6DA35C47
RegCloseKey.ADVAPI32(?,?,6DA35DBD,?,6DA5FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6DA35C65

Strings

Software\7-zip, xrefs: 6DA35C11

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: d16969b53be3617b133b75cd327946152f5f8e701f582123cdb8ed1c74df3c32
Instruction ID: 4cff6dba15625a2777000d9277aa5694d9f4d7dde7264ebfee94d9d2e15ca1de
Opcode Fuzzy Hash: d16969b53be3617b133b75cd327946152f5f8e701f582123cdb8ed1c74df3c32
Instruction Fuzzy Hash: E5119E7690DB38ABCB128F489C40ABFBB78FB45A24F05466AF816E3200D734590586D4

Uniqueness

Uniqueness Score: -1.00%

Function 6DA477E9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,?,6DA47821,6DA2FA7E,?,6DA48143,000000FF,0000001E,6DA58028,0000000C,6DA481EF,6DA2FA7E,?,?,6DA4C6AB,00000004), ref: 6DA477F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6DA47803

Strings

CorExitProcess, xrefs: 6DA477FD
mscoree.dll, xrefs: 6DA477EE

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: ffea90df3f7820ca0bbe85bf8a9bd9cd4a9157573df19fd6932df34af7c57464
Instruction ID: 505a3c5e6f71fe21528bd31e8b7ad47f181753eb2d77064e1fc99049f548716f
Opcode Fuzzy Hash: ffea90df3f7820ca0bbe85bf8a9bd9cd4a9157573df19fd6932df34af7c57464
Instruction Fuzzy Hash: 14D0C9B160D346ABEF402AB28E1CB263AACE9C2A51384C420B56DD2002DB31C8E1D9E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4C748 Relevance: 6.4, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 6DA45F2A: RtlAllocateHeap.NTDLL(00000000,6DA2FA6F,?,00000000,?,?,6DA24D3F,0000000C,E65594C9,?,?,00000000,?,?,6DA4EF9B,000000FF), ref: 6DA45FA1

GetLastError.KERNEL32(?,6DA452D8,00000000,00000010,?,?,?,6DA45364,?,6DA57E10,0000000C,6DA45390,?,?,6DA478CA,6DA4A8C7), ref: 6DA4C8C3
GetLastError.KERNEL32(?,6DA452D8,00000000,00000010,?,?,?,6DA45364,?,6DA57E10,0000000C,6DA45390,?,?,6DA478CA,6DA4A8C7), ref: 6DA4C950

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorLast$AllocateHeap
String ID:
API String ID: 4219743298-0
Opcode ID: 49c6e2c2a6cefef6f88671737f19885e7503646f07f60b3c057725fcb4bdf45c
Instruction ID: e44c9b45ba8dfa43c01a00ce9cb0be56476da6f714ab12840cb69fb99c0c0c4c
Opcode Fuzzy Hash: 49c6e2c2a6cefef6f88671737f19885e7503646f07f60b3c057725fcb4bdf45c
Instruction Fuzzy Hash: 02512376C0D712ABCF115F788D0466E3BB4EF46364B2AC519E958A7285EB34C8C5CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA4C452 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6DA4C1F1: GetOEMCP.KERNEL32(00000000,?,6DA4A6C9,?,?,?), ref: 6DA4C21A

Part of subcall function 6DA4760E: Sleep.KERNEL32(00000000,00000001,6DA2FA7E,?,6DA4815E,00000018,6DA58028,0000000C,6DA481EF,6DA2FA7E,?,?,6DA4C6AB,00000004,6DA582E8,0000000C), ref: 6DA4762F

InterlockedDecrement.KERNEL32(C03314C4), ref: 6DA4C4C8
InterlockedIncrement.KERNEL32(00000000), ref: 6DA4C4ED
InterlockedDecrement.KERNEL32 ref: 6DA4C57F
InterlockedIncrement.KERNEL32(00000000), ref: 6DA4C5A3

Part of subcall function 6DA45FF4: HeapFree.KERNEL32(00000000,6DA2FA7E,6DA57EB0,0000000C,6DA481B5,00000000,6DA58028,0000000C,6DA481EF,6DA2FA7E,?,?,6DA4C6AB,00000004,6DA582E8,0000000C), ref: 6DA4605C
Part of subcall function 6DA45FF4: GetLastError.KERNEL32(?,6DA4C6AB,00000004,6DA582E8,0000000C,6DA47669,6DA2FA7E,?,00000000,00000000,00000000,?,6DA4726D,00000001,00000214), ref: 6DA4606D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$ErrorFreeHeapLastSleep
String ID:
API String ID: 1703371082-0
Opcode ID: cdb2f750906bee63631694620ba0ae805f1e91141020bbe831aef8245abb4c68
Instruction ID: 415724b0d0b59e44e8c9f587602a4207b5f547417582210e0d3901de733b9d10
Opcode Fuzzy Hash: cdb2f750906bee63631694620ba0ae805f1e91141020bbe831aef8245abb4c68
Instruction Fuzzy Hash: F041CC7184C3059BDF019F78CA8076D3BB0BF4A324F19C969D959DB691CB3098C6CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA30F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,E65594C9,00000000,?,?,00000000,00000000,00000000), ref: 6DA30FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6DA3100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6DA31033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 6DA3103F

Part of subcall function 6DA328A0: GetCurrentDirectoryW.KERNEL32(00000105,?,E65594C9,FFFFFFFF,?,00000004), ref: 6DA32994

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: f6ee1b233e71bef38d289f19de88651f4f5f7c4cdf737c8a7a1d16c0d68a33a5
Instruction ID: 810ce8439ca47e0983821ec201642116d52273eddf9f9dc5b71b96a551d5ab4c
Opcode Fuzzy Hash: f6ee1b233e71bef38d289f19de88651f4f5f7c4cdf737c8a7a1d16c0d68a33a5
Instruction Fuzzy Hash: 5C21A175A08304ABEB109F54DC85FBFB7B9EB46764F114229FA15A72C0C7346E4586A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA3D4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6DA5FC98,E65594C9,?,?,?,6DA4FB68,000000FF), ref: 6DA3D4F2
LeaveCriticalSection.KERNEL32(6DA5FC98,?,?,?,6DA4FB68,000000FF), ref: 6DA3D50A
LeaveCriticalSection.KERNEL32(6DA5FC98,?,?,?,?,6DA4FB68,000000FF), ref: 6DA3D547

Strings

[Content], xrefs: 6DA3D52D

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: 45cb563cec6901fbe68d8e581a57257495273d2c6afaa2b297ee65adc397eec8
Instruction ID: 6c8a43cd57b12facdb8a58f8cc6663958c748df6a740f3c93c9440aa334ed014
Opcode Fuzzy Hash: 45cb563cec6901fbe68d8e581a57257495273d2c6afaa2b297ee65adc397eec8
Instruction Fuzzy Hash: 2401D67290C318AFD711DF58C904BAAB7F8FB49620F81866EF801D7780D7756990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DA21A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6DA21A4E
ReadFile.KERNEL32(00000000), ref: 6DA21A55
GetLastError.KERNEL32 ref: 6DA21A72
GetLastError.KERNEL32 ref: 6DA21A80

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 77ea081be48275d4487b09559506aca0c50caf386713606fdea38f6da35e55ec
Instruction ID: 4a44be0da20522073c6ea9417741b57aaa929ec581ba70c33680b9cb705f827c
Opcode Fuzzy Hash: 77ea081be48275d4487b09559506aca0c50caf386713606fdea38f6da35e55ec
Instruction Fuzzy Hash: F601867634830B9BDB04DE959D00BB737ACEB85761F148936F916C6180D735D89197A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA49411 Relevance: 6.0, APIs: 4, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,?,6DA46420,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C), ref: 6DA49440
HeapFree.KERNEL32(00000000,-00000010,?,00000000,?,6DA46420,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9), ref: 6DA49450
HeapFree.KERNEL32(00000000,00000000,?,6DA46420,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA4946D
HeapDestroy.KERNEL32(6DA46420,?,?,?,6DA464EE,?,?,?,6DA57F18,0000000C,6DA465A9,?), ref: 6DA49477

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: FreeHeap$DestroyVirtual
String ID:
API String ID: 765507482-0
Opcode ID: 5e60d3a2c12ae74856af2130a44139cef86d7ebbaf4a1f0ba60571f7bf747eb8
Instruction ID: c66b3ac45e61256c24303b213b546137b87439db915f2035fe8701cb5776ac2d
Opcode Fuzzy Hash: 5e60d3a2c12ae74856af2130a44139cef86d7ebbaf4a1f0ba60571f7bf747eb8
Instruction Fuzzy Hash: 52F0173B648315EFDF216F64CE85B057BB9FB82319F61C0ADE641A60A1C3722866CF14

Uniqueness

Uniqueness Score: -1.00%

Function 6DA32FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6DA35DBD,?,?,6DA35C37,?,6DA35DBD,?,6DA5FCC8,00000000,00000000), ref: 6DA3300E
RegQueryValueExW.ADVAPI32(6DA35DBD,Path,00000000,6DA35DBD,?,6DA35DBD,?,6DA35DBD,?,6DA5FCC8,00000000,00000000), ref: 6DA3304E

Strings

Path, xrefs: 6DA33002, 6DA33045

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: 7042467244f348a2c9b15f0889d9528f10136a8802ba26dcfe35a3fcd06191ab
Instruction ID: be6b3c84ec68e1cd956d2e482dce1e5b83374a0755387979718f1e19e69615ed
Opcode Fuzzy Hash: 7042467244f348a2c9b15f0889d9528f10136a8802ba26dcfe35a3fcd06191ab
Instruction Fuzzy Hash: FB116075A0C215AFDB14DFA5C9C087EF7F9FF49700B1585AEE186D3601E77099808B50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA48C63 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,-00000010,00000000,00000000,6DA491C3,00000000,?,00000000,6DA4EF9B,000000FF,?,6DA2FA7E,?), ref: 6DA48C8A
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,6DA491C3,00000000,?,00000000,6DA4EF9B,000000FF,?,6DA2FA7E,?), ref: 6DA48CC0
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,6DA2FA7E,?), ref: 6DA48CDA
HeapFree.KERNEL32(00000000,?,?,6DA2FA7E,?), ref: 6DA48CF1

Memory Dump Source

Source File: 00000004.00000002.168292372339.000000006DA21000.00000020.00000001.01000000.00000006.sdmp, Offset: 6DA20000, based on PE: true

Associated: 00000004.00000002.168292312078.000000006DA20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292570437.000000006DA53000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.168292792800.000000006DA5D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6da20000_TDService.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: a5ba02846204e32ae75925416158125f10f0d9ad83877a234e6d24600221f233
Instruction ID: 174a2522a11478df4e0f95e1de4b3ce51184204457c7ae8c95bbc30205df3916
Opcode Fuzzy Hash: a5ba02846204e32ae75925416158125f10f0d9ad83877a234e6d24600221f233
Instruction Fuzzy Hash: 01113A77549711EFDB229F28DC05B167BB5FB87724B24CA5EE692D3190E33098828B90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TDService.exePID: 6476, Parent PID: 908COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.9%
Total number of Nodes:	124
Total number of Limit Nodes:	7

Executed Functions

Function 0142B940 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

listen.WS2_32(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142B9D4

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: 15dfc79690fc0c442f579b58d2056ad93d987a847db8f9384f82fe60cc44661d
Instruction ID: a7de22d5806475b1084093f2b8b54b5ec56adc09d6bb63e1e5ae1ef7d67edca1
Opcode Fuzzy Hash: 15dfc79690fc0c442f579b58d2056ad93d987a847db8f9384f82fe60cc44661d
Instruction Fuzzy Hash: DD21F7B54047805FE712CB50DC45F96BFB8EF42324F1884DBE9449F293E3649909C761

Uniqueness

Uniqueness Score: -1.00%

Function 04361627 Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 043616AB

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: fc13adef3ccdad48c1d90b19d84fe24b9a9f5c4b3f617d53b7a6a3e94656379c
Instruction ID: 30ccb01434eb0267b03f7b41adac275e7e7b3268b484cd2d8c806a9946991fcb
Opcode Fuzzy Hash: fc13adef3ccdad48c1d90b19d84fe24b9a9f5c4b3f617d53b7a6a3e94656379c
Instruction Fuzzy Hash: 7B21B0B55087846FE721CF51DC88F96BBA8EF45310F08C49BE945DB252D364A908CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0436164A Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 043616AB

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 83670892283390fa1e772acd3ebdea63564b0048b8d9bec78de3e73e36f219d9
Instruction ID: 87c571163a1188150158fe64d9750b8e74d79ef14af7f9672fe58fb9890643e5
Opcode Fuzzy Hash: 83670892283390fa1e772acd3ebdea63564b0048b8d9bec78de3e73e36f219d9
Instruction Fuzzy Hash: D01190B56006049FEB20CF55DC84FA6B7ECEF04714F08C46AED059B655E774E808CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0142A3B6 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32(?,2FE2A08F,00000000,?,?,?,?,?,?,?,?,6CC33C58), ref: 0142A414

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 8ab8f2c912154c1aefeb169284bb266205768ecd7cc27b16a3e98c80965ec90f
Instruction ID: e99e1188f600f719e1e58dba006947a7ee49ebf34289ca7cfd746bfcedea93da
Opcode Fuzzy Hash: 8ab8f2c912154c1aefeb169284bb266205768ecd7cc27b16a3e98c80965ec90f
Instruction Fuzzy Hash: F811C8715093809FDB128F25DC94B52BFB4EF02220F0884EBED858F653D275A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0142B97E Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

listen.WS2_32(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142B9D4

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: 4e58b6167fd16de4e629e9f815b2633c49a7f0fdff7fb76112603708afb3126d
Instruction ID: 47ed2d393eeea1906ee8d3ee064583f3c641f8a791caf4986dd983adafa31621
Opcode Fuzzy Hash: 4e58b6167fd16de4e629e9f815b2633c49a7f0fdff7fb76112603708afb3126d
Instruction Fuzzy Hash: F211C271500604AFEB21CF55DC85BA6B7E8EF44725F04C49BED049B752E374A449CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0142A3E2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32(?,2FE2A08F,00000000,?,?,?,?,?,?,?,?,6CC33C58), ref: 0142A414

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: e0a916adc03901000bf8ae248a8f4fc3db4aef62497843f5b78aad9573b9c923
Instruction ID: 6d3dfaf3a34f55bd7a6e445bc0a09df7cc2f50555e1deedb0a63b943da2ae550
Opcode Fuzzy Hash: e0a916adc03901000bf8ae248a8f4fc3db4aef62497843f5b78aad9573b9c923
Instruction Fuzzy Hash: B80184759002409FDB10CF19E889766FBD4DF04625F58C4ABDD098FB56D275E448CA62

Uniqueness

Uniqueness Score: -1.00%

Function 04360366 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 04360398

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c50cf3fab43274d8ec488c25a22bca8e392cc5e62a36b3f0704574c3beada203
Instruction ID: bf91bd5da7a5651faf669ba55a011e977cfe18ea162a1d495bdd7d5550773008
Opcode Fuzzy Hash: c50cf3fab43274d8ec488c25a22bca8e392cc5e62a36b3f0704574c3beada203
Instruction Fuzzy Hash: 3901A2759006408FDB10CF19E885B69FBE4DF05621F18D4AADD498F646E3B5A448CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01590761 Relevance: 3.9, Strings: 3, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/l, xrefs: 0159096E
\O0l, xrefs: 01590923
/l, xrefs: 015908F8

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: /l$ /l$\O0l
API String ID: 0-4120838383
Opcode ID: 6df166c5cb13f0221619848b6bad38351c13781fa4136b425f03044867cdca98
Instruction ID: 85a92c7d54f327f32994278d094b5fa37518a34a330140d9f270ad67e06282ed
Opcode Fuzzy Hash: 6df166c5cb13f0221619848b6bad38351c13781fa4136b425f03044867cdca98
Instruction Fuzzy Hash: 07613770B002158FCB44EF78C49089DBBF2AF89218764846EE50AEB365DB36DD46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01590770 Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/l, xrefs: 0159096E
\O0l, xrefs: 01590923
/l, xrefs: 015908F8

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: /l$ /l$\O0l
API String ID: 0-4120838383
Opcode ID: b69cb7e7ccb25a6395a67e41694eeebb5d74368d2b6115989a513d917ddc0e05
Instruction ID: 894980e7866503dfc0f62aea5bdd55f2dfd58800f235981ec310da0967f56b57
Opcode Fuzzy Hash: b69cb7e7ccb25a6395a67e41694eeebb5d74368d2b6115989a513d917ddc0e05
Instruction Fuzzy Hash: A5613770B002158FCB44EF78C49089DBBF2AF89214765846EE50AEB365DB36DD46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 015909CF Relevance: 3.9, Strings: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/l, xrefs: 01590A77
/l, xrefs: 01590A95
/l, xrefs: 01590A81

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: /l$ /l$ /l
API String ID: 0-4220630555
Opcode ID: a28666834351cf9d946d93d455805581f2886d8cb205d0d8f5de17c3ee83304d
Instruction ID: 429b822ecddfae4afd408062f9069aaf5775da9e009976f00cb6ba228bf0923f
Opcode Fuzzy Hash: a28666834351cf9d946d93d455805581f2886d8cb205d0d8f5de17c3ee83304d
Instruction Fuzzy Hash: 64515D30A00619CFDB25DF34C454A99B7B6BF45314F0188A9E909AF752DB72ED86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 015909E0 Relevance: 3.9, Strings: 3, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/l, xrefs: 01590A77
/l, xrefs: 01590A95
/l, xrefs: 01590A81

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: /l$ /l$ /l
API String ID: 0-4220630555
Opcode ID: f625cb786513bea6957e084068dd0ae9ae26efc405f194914a12bce0bdc60fb0
Instruction ID: e410c6c64dabe6e536f8b3db9d6f73d20f2f666fc0e43806bd71b72a976d204d
Opcode Fuzzy Hash: f625cb786513bea6957e084068dd0ae9ae26efc405f194914a12bce0bdc60fb0
Instruction Fuzzy Hash: B6514B30A00619CFDB25DF34C454A99B7B6BF45314F0188A9E909AB752DB72ED86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 015901A0 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dS0l, xrefs: 0159020C
dS0l, xrefs: 0159022E

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: dS0l$dS0l
API String ID: 0-2663856297
Opcode ID: b1254dd55346e7c2fd4c47c07a502bf5700aff16d420eb1cd7ad0c2000b10fe2
Instruction ID: d96a0399ad8e7834fb7c6233934c5171740a74391a734b555ab3fd72cf35479c
Opcode Fuzzy Hash: b1254dd55346e7c2fd4c47c07a502bf5700aff16d420eb1cd7ad0c2000b10fe2
Instruction Fuzzy Hash: 62519D303006158BCB09AB38D4A066E73A7AFD920CB64886ED5469F365DF7DDC0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 015901B0 Relevance: 2.6, Strings: 2, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dS0l, xrefs: 0159020C
dS0l, xrefs: 0159022E

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: dS0l$dS0l
API String ID: 0-2663856297
Opcode ID: 965f55dbedc482666314e9d928aad7ee4a6cbdb057610f21d8c0057220e518be
Instruction ID: 05bac6ffc2a82295ca1adfa1af44264ea27709f6fd17c5861f1d96e54805aafd
Opcode Fuzzy Hash: 965f55dbedc482666314e9d928aad7ee4a6cbdb057610f21d8c0057220e518be
Instruction Fuzzy Hash: 5B419E303006158BCB09BB39D4A066E72A7AFD910CB648C2ED54ADF365DF79DC0ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0142BA24 Relevance: 1.6, APIs: 1, Instructions: 104
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 0142BAE9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3690d8c66e8f8f3b6cad19b93877abaad96307da6ad8f0083f079a277995902e
Instruction ID: edc31699c3e427342f17f32d9c9d521631ba79edde1cd9f8611b821ece82d729
Opcode Fuzzy Hash: 3690d8c66e8f8f3b6cad19b93877abaad96307da6ad8f0083f079a277995902e
Instruction Fuzzy Hash: 7F31AD71504744AFE7228B25DC44FA7BFFCEF09610F08849AF985CB662E260E449CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0436080A Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 043608C9

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2d138d3120320312f3ed01390cd5978ebb92d99d3613881ff9232ebe0ea0698e
Instruction ID: 72556bd021066677542ba1d92334eb40320984a117b23c2c2fa3e2193439cff1
Opcode Fuzzy Hash: 2d138d3120320312f3ed01390cd5978ebb92d99d3613881ff9232ebe0ea0698e
Instruction Fuzzy Hash: 0931B371504780AFE712CF65DC45BA2BFF8EF06310F08849AE9858B652E375A509DB71

Uniqueness

Uniqueness Score: -1.00%

Function 04360B87 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 04360C4E

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f96d3757456adb863f7c657538087bbb00bec9ceaf0847fc24beff98aa95d0b0
Instruction ID: 3d4771d36a0ec2544ac31d3b2b108a88673831269235bcb32b1094d727e06df4
Opcode Fuzzy Hash: f96d3757456adb863f7c657538087bbb00bec9ceaf0847fc24beff98aa95d0b0
Instruction Fuzzy Hash: 0831907110E7C06FD3138B258C65A61BFB4EF47614B0E85CBD8C48F5A3D2196809C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0142B1FE Relevance: 1.6, APIs: 1, Instructions: 93
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142B2B8

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a0eb44ef75b3f908e911aaf4c923b865f66d4e6ad1f539980b7b8fd97471a351
Instruction ID: b6d5506ad5802418917ef9d34b9dd29268839b5fab01f6322708f0f726c96f5c
Opcode Fuzzy Hash: a0eb44ef75b3f908e911aaf4c923b865f66d4e6ad1f539980b7b8fd97471a351
Instruction Fuzzy Hash: 95318F715097845FE722CB25DC44B96BFB8EF06610F0884DBE984CB2A3D264E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0142A709 Relevance: 1.6, APIs: 1, Instructions: 90
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0142A7B9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 94e92717a0c8f51c97f8a68d088517ff637a67dbeb608e40ca4a83aee5a33296
Instruction ID: 379e1f4a692aa02c790942c1eb844326a50bf832546e1d42e1955fcec06cdd14
Opcode Fuzzy Hash: 94e92717a0c8f51c97f8a68d088517ff637a67dbeb608e40ca4a83aee5a33296
Instruction Fuzzy Hash: 3731A271408744AFE7228B65DC84FA7BFBCEF05214F08849BE945CB662D264E94DCB71

Uniqueness

Uniqueness Score: -1.00%

Function 043603D6 Relevance: 1.6, APIs: 1, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterEventSourceW.ADVAPI32(?,?), ref: 04360476

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 7486d0e608d7b540b220363e27e0aef66b99cfbe27b56c98927be8a07ecb0ad7
Instruction ID: 633a9a7ac0899074a7180c926fe50310291fbc4459a4ca3a1da5d0a2d57f1f26
Opcode Fuzzy Hash: 7486d0e608d7b540b220363e27e0aef66b99cfbe27b56c98927be8a07ecb0ad7
Instruction Fuzzy Hash: 97318FB15093806FE722CB65DC45B56BFF8AF06210F18849AE944CB293E364E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04361520 Relevance: 1.6, APIs: 1, Instructions: 88
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 043615BD

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 09665161f81887aca349a34e8dd366c4fba7753ee6e060f1482c7b6872cd4b83
Instruction ID: 751d784699b037bd48ed8d494d3f50532c789b419ca4f8357eec33fb01f2c721
Opcode Fuzzy Hash: 09665161f81887aca349a34e8dd366c4fba7753ee6e060f1482c7b6872cd4b83
Instruction Fuzzy Hash: 6C31F7715057806FEB128F60DC44F96BFB8EF06314F08849BE985CB153D364A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04360FAE Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 0436104B

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 23171f430c59160cd1624a131812f8b7a072bd3bb590cc3c7200e71aa608cef6
Instruction ID: 783c2b54c76b3c446fc32c9e5c7a85cfa3e3c7530b64267ff83c9aa909af1033
Opcode Fuzzy Hash: 23171f430c59160cd1624a131812f8b7a072bd3bb590cc3c7200e71aa608cef6
Instruction Fuzzy Hash: 422193B1504385AFEB21CF65DC44FA7BBF8EF45310F08849AE945DB652D364A809CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142BA4E Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 0142BAE9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ecd8c3a23dc9bc712c64dbaca0644ca46875a0a1a3efbc9c0639cbbccf516e87
Instruction ID: 798a2130ea2b887e90774384c78cf861cebd4ebfc6e0135557717484ace210d5
Opcode Fuzzy Hash: ecd8c3a23dc9bc712c64dbaca0644ca46875a0a1a3efbc9c0639cbbccf516e87
Instruction Fuzzy Hash: D121AD72500604AFEB218F59DC84FA7BBECEF08614F04855AE945C7B62E770E549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0142B849 Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0142B8E9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3f1dd37706dc99b09988a855621b03e5a17c9b38391ce94ba0d252967292bab1
Instruction ID: 0e387e024f43bcda3647e86037e2bf634c699de501e397c23d173a999b1cbdce
Opcode Fuzzy Hash: 3f1dd37706dc99b09988a855621b03e5a17c9b38391ce94ba0d252967292bab1
Instruction Fuzzy Hash: 5631A2B1509380AFE712CB65DC45F96FFF8EF05210F08849AE9848B252D375E849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142BE68 Relevance: 1.6, APIs: 1, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BF0C

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ce8cafc5a6883792fb7c99fefac20216b06bf49763efe8108faea75d5fb38572
Instruction ID: e28f864be1e1baa4472f543f9b3143ddeffd232792fff1cd3bd196ca8bbb51f8
Opcode Fuzzy Hash: ce8cafc5a6883792fb7c99fefac20216b06bf49763efe8108faea75d5fb38572
Instruction Fuzzy Hash: 7A21A2B15047406FE722CB15DC44F63BFF8EF06720F08849AE9858B663D264E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0142BB31 Relevance: 1.6, APIs: 1, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BBE0

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 49a5d2178ca51a4426e097299dd51b91ee7b5de972f232cb58b72afa9be55ab0
Instruction ID: a75d395a67a81c24952e5d43727ff7e91f4ac1a429dbfd7e8bf80901d0773e14
Opcode Fuzzy Hash: 49a5d2178ca51a4426e097299dd51b91ee7b5de972f232cb58b72afa9be55ab0
Instruction Fuzzy Hash: 3731E1724087806FD7228B659C44B93FFB8EF06310F0884CFE9858B6A3D364A449C761

Uniqueness

Uniqueness Score: -1.00%

Function 043617C4 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 04361847

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: fbf599b80762bcea3e6ae8222e86229a15869089769c3bcc93260ac476175091
Instruction ID: d3b9f52731aacf2304b404d84c0ca6502a5d2a41a645639cb96786f39d429313
Opcode Fuzzy Hash: fbf599b80762bcea3e6ae8222e86229a15869089769c3bcc93260ac476175091
Instruction Fuzzy Hash: 8721AE7540D3C45FEB138B25DC65A52BFB4AF07220F0DC0DAD8898F2A3E265A849D762

Uniqueness

Uniqueness Score: -1.00%

Function 0142B5E4 Relevance: 1.6, APIs: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,00000E24,?,?), ref: 0142B68A

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: afc0ade4a959ff85380f762e96ad854d4e6523ed68dd15f792876c0d4d7ab9c8
Instruction ID: b3a59203ba2efd0268b84d853b2d7594553861e2f454632510bbae5ef708e85e
Opcode Fuzzy Hash: afc0ade4a959ff85380f762e96ad854d4e6523ed68dd15f792876c0d4d7ab9c8
Instruction Fuzzy Hash: 46215C6550E3C06FC3138B758C55A21BFB4EF87A10F1D81DFD8849B6A3D225A91AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04360C7A Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 04360D06

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 9816d868c16d901c7f8239e218d283eff1708ad17e5c1b5ef1578a6e0ead94ac
Instruction ID: 05846f8ff3846a29bc0454bb77aef3980400bd5f534178cb621dc838ad3e8a95
Opcode Fuzzy Hash: 9816d868c16d901c7f8239e218d283eff1708ad17e5c1b5ef1578a6e0ead94ac
Instruction Fuzzy Hash: D6217E71405780AFE722CF61DC45F96FFF8EF05210F08889EE9858B692D375A419CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0436116A Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 043611FE

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 84946002826a7d744963f9ae7c270cce2b18361b82b42c058960e0cf01b96b98
Instruction ID: 2e44e9aa8e95ec1b81653cd2bc6cb28cbcd53447152fe77b00b32a783be3442b
Opcode Fuzzy Hash: 84946002826a7d744963f9ae7c270cce2b18361b82b42c058960e0cf01b96b98
Instruction Fuzzy Hash: 0721B171404744AFEB22CF55DC44F96FBF8EF09314F08849EE9858B252D365A549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04360FDA Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 0436104B

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: be3582fbe087fdbcbb225c39980f7d8a41349067466dc615e2de468db7c67182
Instruction ID: 2fd289cfb405ad5755ab508ee7e2d9d9b8aac454b94ccd17b4c2712e2f92215a
Opcode Fuzzy Hash: be3582fbe087fdbcbb225c39980f7d8a41349067466dc615e2de468db7c67182
Instruction Fuzzy Hash: 4D210172600645AFEF20DF25DC84FAABBECEF00314F04C86AE905DB651E370E4088A71

Uniqueness

Uniqueness Score: -1.00%

Function 0436084A Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 043608C9

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 943f82383c63c58bfc30cec748c51583f4af2cb51cb6d48eb6ec5fd9c8a34d39
Instruction ID: f40bdfab1cfdeab54c2076afbc024cb7cc1128b52565ea6ecdcef7df3c48ac1f
Opcode Fuzzy Hash: 943f82383c63c58bfc30cec748c51583f4af2cb51cb6d48eb6ec5fd9c8a34d39
Instruction Fuzzy Hash: 0521AE71600605AFEB20DF65DC85F66FBF8EF04310F04845AE98A8B652E371F409CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142BCD2 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BD64

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 60f015a2e00b03980ebaf829e76caf81a59d20879ea80043a61df5b6e450f0c0
Instruction ID: 25df16128398fd1b1b850e1b6a5305701825a75147cdf17dd01ab1587d99c32a
Opcode Fuzzy Hash: 60f015a2e00b03980ebaf829e76caf81a59d20879ea80043a61df5b6e450f0c0
Instruction Fuzzy Hash: EA21AFB25047406FE7228B55DC44FA7BFF8EF05610F08849BE9459B2A2D264E849CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0142A73A Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0142A7B9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ea7ce056464421ef6fdfb442ed8630fe6edc991b3d16dcd01fc32507d3d89e1c
Instruction ID: 355876f406074c5b838dc5fea4fad5b83c79ea8226dc82f3a694ee0235d967a5
Opcode Fuzzy Hash: ea7ce056464421ef6fdfb442ed8630fe6edc991b3d16dcd01fc32507d3d89e1c
Instruction Fuzzy Hash: 3721CFB2500604AEE721DB55DC84FABFBECEF04714F04845AED458BB62E370E58D8AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0142B876 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0142B8E9

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 5625271e7a93d17cec3d2ee450c916cead26e37bdadc26eb8381107a9a85ade3
Instruction ID: c279e0c5054e5f9e083a84018cdd4077d52c47bac1b3507cfefe3c5ceba7532e
Opcode Fuzzy Hash: 5625271e7a93d17cec3d2ee450c916cead26e37bdadc26eb8381107a9a85ade3
Instruction Fuzzy Hash: B7219271600244AFE711DF69DC85BA6FBE8EF04714F04846AED48CB751E371E449CA65

Uniqueness

Uniqueness Score: -1.00%

Function 04360406 Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?,?), ref: 04360476

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 63adc6c3aee84073e4339207e3ee8a3f7d878a008000fd6b0e00214f8bfe23fc
Instruction ID: f5368bd76da932a2b75be823adf23632ac142e3fbec6ad3e62adcb137a0cb3c9
Opcode Fuzzy Hash: 63adc6c3aee84073e4339207e3ee8a3f7d878a008000fd6b0e00214f8bfe23fc
Instruction Fuzzy Hash: A121D1B1600200AFE721DF65DC86BA6BBE8EF04324F14C469ED49CB786E775E409CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0142BDAC Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BE2D

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a81debac3a433a385017ff25b9d4acab5fa8e1016bbe9c004999bee0e1e69de8
Instruction ID: cff69d0fa0fd5e68be0c112d8cfff5aae3460a5f1f127a36209f03835cd07cc7
Opcode Fuzzy Hash: a81debac3a433a385017ff25b9d4acab5fa8e1016bbe9c004999bee0e1e69de8
Instruction Fuzzy Hash: 4F21D271504780AFE7128B55DC44BA3BFACDF46724F08849AEA848B262D275A809CB75

Uniqueness

Uniqueness Score: -1.00%

Function 04360A12 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 04360A91

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7ca0e322f5c8ec0b880cbf75c48c7724177254bf7a3b90cb95a867df603cd5e3
Instruction ID: 1534ee11e68724d75fa17f7c2d66eb5bca1205e134e117f623271c474e0bec07
Opcode Fuzzy Hash: 7ca0e322f5c8ec0b880cbf75c48c7724177254bf7a3b90cb95a867df603cd5e3
Instruction Fuzzy Hash: 46219F71405780AFD722CF51DC44FA6BFF8EF45320F08849AE9459B652D364A409CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 04361709 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04361784

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: febebc163e7687dea1adbc6b4a7093d3f6fd605816837f336ff72ae3baa4f71c
Instruction ID: 8e2527b1f8cf44dc390ae855718b3478e8daf1689b036802be8c8b18edf6a365
Opcode Fuzzy Hash: febebc163e7687dea1adbc6b4a7093d3f6fd605816837f336ff72ae3baa4f71c
Instruction Fuzzy Hash: DD216A715043859FDB21CF25D884B62BFF8EF06210F08859AE949CB266E361E818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142B23E Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142B2B8

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1fde6c3402a0f77595aeaf0afbbb7b44b7ef4b58048131c551a0eae4c5199950
Instruction ID: 29c2f8d0ef2e567fbd1bc14606f7afd172b920237ee379c5435890f196700764
Opcode Fuzzy Hash: 1fde6c3402a0f77595aeaf0afbbb7b44b7ef4b58048131c551a0eae4c5199950
Instruction Fuzzy Hash: 6D215B756007049EE721CF59DC88FA7BBECEF05610F04845AEA458B761E770E488CA75

Uniqueness

Uniqueness Score: -1.00%

Function 04360C9A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 04360D06

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 789caedd2ba77d87348a7e91761f07ccf5354140e502c957ff15ab9b4cc0780e
Instruction ID: 8e44bdd99a1c034afbf0a362beb371df8e4cb9748e3f972d91f81da24447896d
Opcode Fuzzy Hash: 789caedd2ba77d87348a7e91761f07ccf5354140e502c957ff15ab9b4cc0780e
Instruction Fuzzy Hash: 5821CF71500600AFEB21DF65DC45BA6FBF8EF04320F04885AEA4A8B691E371B409CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0436118A Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 043611FE

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 68c63cc67da698dd5a838259dfc347f4f9d81f3f34c101fd470ce3fda3d48f49
Instruction ID: de99eb4d731608c9da0b8f1747183a10ed35c24bd1b54f2f201213f1d35773bb
Opcode Fuzzy Hash: 68c63cc67da698dd5a838259dfc347f4f9d81f3f34c101fd470ce3fda3d48f49
Instruction Fuzzy Hash: 7921DE71500604AFEB21CF65DC85FA6FBE8EF08324F04845AE9498B655E371F449CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142BCF2 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BD64

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4a961bca5b6852d2a46a0f5117724c08569bdd4fe126c398470b59140ef239b6
Instruction ID: dde42acd6bf62ed15de2087fd6243eadb4934a9eb837f6c4568242697afb879b
Opcode Fuzzy Hash: 4a961bca5b6852d2a46a0f5117724c08569bdd4fe126c398470b59140ef239b6
Instruction Fuzzy Hash: 5111B176500600AFE7218E15DC84FA7FBE8EF04710F04C45AED458B762E374E44ACAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0142BE9A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BF0C

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c70e1242c2652b37ac5776edb43a6feb84b88d95b500f3a121b041671169b61a
Instruction ID: 326433fe1012b017505c6cce132318471e62a7a02346b770dec1d652913a40e3
Opcode Fuzzy Hash: c70e1242c2652b37ac5776edb43a6feb84b88d95b500f3a121b041671169b61a
Instruction Fuzzy Hash: 3D116A76500604AEE721CE59DC84FA7BBE8EF04720F08845AEA458B762E371E449CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142A45B Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 0142A4CE

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0d456936144949fc55ad61cbb45f15f747fafa90dcd3d791a212d1170851eef4
Instruction ID: 846b12322b300b2bfe1a65622cfe4433704b61b4ff39c651aec902cf4caf9f6d
Opcode Fuzzy Hash: 0d456936144949fc55ad61cbb45f15f747fafa90dcd3d791a212d1170851eef4
Instruction Fuzzy Hash: 64218E754093C09FD712CB65DC84B92BFF4EF06210F0984DBD9848F263D2759849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04360329 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 04360398

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 29235680d858cb64d62c2be813825bdb92968aa3dd582aba5e39456bea13ad8b
Instruction ID: f3f72207e93602d0fc30d46feca43347e5cf935b8782ba3458725f176110d763
Opcode Fuzzy Hash: 29235680d858cb64d62c2be813825bdb92968aa3dd582aba5e39456bea13ad8b
Instruction Fuzzy Hash: B011CD714093809FD7128F25D885B56BFB4EF03220F18C4EADC848F263D265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0436155E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 043615BD

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: c7bfda0ba884455cf8bf5b25da6a31a2c65a53df965454cb25fc98b2207ff81a
Instruction ID: 0b8d7fdc3ee5db4860e4534fc1ef99f02f1489a7048b36cd9967c3504c4b4041
Opcode Fuzzy Hash: c7bfda0ba884455cf8bf5b25da6a31a2c65a53df965454cb25fc98b2207ff81a
Instruction Fuzzy Hash: 6111D371500601AFEB218F55DC44FAAF7E8EF04715F04C45AEE468B655E770E408CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142B497 Relevance: 1.6, APIs: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(?,00000E24,?,?), ref: 0142B516

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 4f16809e553ec0f6c092127bb576617cfd3e9cec688bfbb44198201e1ee08828
Instruction ID: 7cd78b6f982aee0b81f6020902a4397517fcac89e6539659750054ccb00a673e
Opcode Fuzzy Hash: 4f16809e553ec0f6c092127bb576617cfd3e9cec688bfbb44198201e1ee08828
Instruction Fuzzy Hash: 92110471504740AFD312CB19DC41F72FFF8EF86A20F09819AEC489BA42D235B916CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142B153 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0142B1BE

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c3bc5ade063042420b2a3b9a6e2b6a321803b87e0da1f42bd83d1e7ca34260e
Instruction ID: e7460bfaa44c64fd069598b8c7627465fc2a32700b95d26f496d1c8e937fccc9
Opcode Fuzzy Hash: 7c3bc5ade063042420b2a3b9a6e2b6a321803b87e0da1f42bd83d1e7ca34260e
Instruction Fuzzy Hash: 4F11AF71408380AFDB228F55DC44B62FFF4EF4A210F0888DAED858B263D275A419DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142BB76 Relevance: 1.6, APIs: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BBE0

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d755125778840edc3470fb75e4f1ed907d237d789edbb573ad73e0f17e31166d
Instruction ID: 0400fb47842ca6e26acf7cba76f2b4b991627adebf91c98f3d3514aceb4d4261
Opcode Fuzzy Hash: d755125778840edc3470fb75e4f1ed907d237d789edbb573ad73e0f17e31166d
Instruction Fuzzy Hash: 9811BF72500600AFEB318F55DC84FA7FBE8EF04710F04845AEA459BB62E774E489CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 04360A32 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 04360A91

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 81917a682e02fe1e6af5e40874c7138b38ee2f9c65fd6f6e5ba7e88931d4f0c1
Instruction ID: 08f2dfd1a7875724e2cb6d3b7f47b68d5611d0babc7e8ddfc9304b6bf616d6ac
Opcode Fuzzy Hash: 81917a682e02fe1e6af5e40874c7138b38ee2f9c65fd6f6e5ba7e88931d4f0c1
Instruction Fuzzy Hash: 3E11BF72500600AFEB21CF55DC85FA6FBE8EF04724F04C45AEA459B655E374A409CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0142AD1E Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?), ref: 0142AD8A

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 75c983162cb795bfe8b11657cd1ad2595d860f7267342800f5690154b48f350f
Instruction ID: dfd265969d51bf8f573122be3f14e633d00b42a43793011e48662292162d85f1
Opcode Fuzzy Hash: 75c983162cb795bfe8b11657cd1ad2595d860f7267342800f5690154b48f350f
Instruction Fuzzy Hash: A61190714043809FDB228F55DC84B52FFF4EF49310F08899EE9858B562D375A459CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0436172E Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04361784

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 6ace479b36e1a24a54b16ad4717ffb5d69ad82c531aa662506192422ce97e342
Instruction ID: 80153f452b41064083353151a25b87f43f8e2a43339a335887da1f5955344788
Opcode Fuzzy Hash: 6ace479b36e1a24a54b16ad4717ffb5d69ad82c531aa662506192422ce97e342
Instruction Fuzzy Hash: 03113D756006059FDB20CF69D984B66FBE8EF04710F08C4AADD49CB656E771F448CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04360188 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetServiceStatus.SECHOST(?,?), ref: 043601DF

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 64b04f6a8124a76856e8815317b85e0cce1fb0cbbd6c0aa74b71afff1e1c08ed
Instruction ID: d5c7f778f26fc0cc767418c3e0040f564d772e719388a9c69d713ba49645aa89
Opcode Fuzzy Hash: 64b04f6a8124a76856e8815317b85e0cce1fb0cbbd6c0aa74b71afff1e1c08ed
Instruction Fuzzy Hash: 3C11C1715083849FDB11CF25DC85B56BFF4EF06220F0884EEED458F266D274A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142A67A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0142A6D8

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 59dc24b01a591040d0987817cd00b254fbefd776727291986103df15bb6de852
Instruction ID: 53c67db2ea1c56ddc900ac2bb7fcb9e6681247bef4f1626c2ac45b3f344f5962
Opcode Fuzzy Hash: 59dc24b01a591040d0987817cd00b254fbefd776727291986103df15bb6de852
Instruction Fuzzy Hash: 081191754093C46FD7238B15DC44B62BFB4EF46624F0980CBED858B263D265A849CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0142BDDA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,2FE2A08F,00000000,00000000,00000000,00000000), ref: 0142BE2D

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a9e63a33edb15c1cb416851339b8ed28aec9ebb61f31b919751d24aca269b2f3
Instruction ID: 161c477e1be5aebc83f4aaf70281b54c6ef6b05d887079f48fd090049bacdd31
Opcode Fuzzy Hash: a9e63a33edb15c1cb416851339b8ed28aec9ebb61f31b919751d24aca269b2f3
Instruction Fuzzy Hash: 3801D271500604AEE721CB15DC85BA6F7E8DF04724F04C097EE088B762E3B4E489CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0142AA88 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0142AADC

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4834a0242080644be3527a78629de56ec5ff9b887ec8079630eab865693d31aa
Instruction ID: afab1cefdab9f0c53aa1c22f99cb4ec112882596e09dde24fef82e97a8d60edb
Opcode Fuzzy Hash: 4834a0242080644be3527a78629de56ec5ff9b887ec8079630eab865693d31aa
Instruction Fuzzy Hash: 081182715083849FDB12CF15DC84B52BFA4EF46221F0884DAED449F257D275A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0142AD46 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?), ref: 0142AD8A

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 2088c5b6ac7393b779856c4cf619ca370dd73931c752b07018214ea55f08cec5
Instruction ID: 05482a0a569c90f354a0d0be7108a5a8c5cfcb5396e07a268b20375b9716086d
Opcode Fuzzy Hash: 2088c5b6ac7393b779856c4cf619ca370dd73931c752b07018214ea55f08cec5
Instruction Fuzzy Hash: 1D016D72400600DFDB218F55D884B66FBE1EF08721F18899ADE494BA22D375E459DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0142B17A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0142B1BE

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64256a36977a45f6a9f5550f66bad24712b6d8ebd44409c09cabff1c73f09eaf
Instruction ID: 6efc29a8bea7b34529dd15effea3824f40595133c9d202eafda6d457e2323870
Opcode Fuzzy Hash: 64256a36977a45f6a9f5550f66bad24712b6d8ebd44409c09cabff1c73f09eaf
Instruction Fuzzy Hash: 5A016D32400740DFDB21CF59D884B66FBE0EF08720F18899ADE498A662D3B5E459DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0142A48E Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,?,?), ref: 0142A4CE

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7c073daf686453536f63b6eeaf4905ffeb06e8c39f0329488397c0b3363fbd57
Instruction ID: 6e171aa95f7f2b430dd1cb257f5110f801ed2b37a4ac8e35ac624e47d5d0ac99
Opcode Fuzzy Hash: 7c073daf686453536f63b6eeaf4905ffeb06e8c39f0329488397c0b3363fbd57
Instruction Fuzzy Hash: AA0192719002008FEB20CF19E884B66FBE4EF04721F1884ABDD498B752E375E488CA61

Uniqueness

Uniqueness Score: -1.00%

Function 043601AA Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetServiceStatus.SECHOST(?,?), ref: 043601DF

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 68468baa487edecfa9f79553c2d8e1404f01b6446416d7f6b332c13d40c59e30
Instruction ID: d7527d61ad924470dd17da170838272aa5d82ec82907bc4f4eebe45994b99e32
Opcode Fuzzy Hash: 68468baa487edecfa9f79553c2d8e1404f01b6446416d7f6b332c13d40c59e30
Instruction Fuzzy Hash: CC01D4755002058FEB10CF19E885B66FBE4EF04220F08C4AADD4A9F65AE375E448CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04361802 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

FindWindowW.USER32(?,?), ref: 04361847

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 07e837418e665017f5223c3280190273ff58050d044f104feff8e5f08f9128bc
Instruction ID: 49da65717eef2522e30a1769d038ffda0ba725221ceefa81a074d699e32def41
Opcode Fuzzy Hash: 07e837418e665017f5223c3280190273ff58050d044f104feff8e5f08f9128bc
Instruction Fuzzy Hash: D7017175A006459FEB20DF19D885B62FBE8EF04620F08D099DD4D8B75AE274F448CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142B4C6 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(?,00000E24,?,?), ref: 0142B516

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 916954410f81f6d136de84df812188613db9b4c16161f6116ec42d7b0c759dbf
Instruction ID: 38f33794ec3f0f247c3a5de162d61ad43d9319f98d5cee1ae87f4a47d3d66afe
Opcode Fuzzy Hash: 916954410f81f6d136de84df812188613db9b4c16161f6116ec42d7b0c759dbf
Instruction Fuzzy Hash: 6001A271500601ABD210DF1ACC86B66FBE8FB88B20F14815AED089BB41E771F916CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0142B63A Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,00000E24,?,?), ref: 0142B68A

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: c79fe82b788179b8a910527ef5f5b63935f3459e4dfa9123e11685de7fbeb251
Instruction ID: 76e33323f0f82d2170d881c9a0048a659a15730fb84dde71f585cfacf0545a6e
Opcode Fuzzy Hash: c79fe82b788179b8a910527ef5f5b63935f3459e4dfa9123e11685de7fbeb251
Instruction Fuzzy Hash: 5301A271500601ABD250DF1ACC86B66FBE8FB88B20F14811AED089BB41E771F916CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 04360BFE Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 04360C4E

Memory Dump Source

Source File: 0000000B.00000002.172707047992.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4360000_TDService.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6fe3ca039ad29bc2c7d261886641ceef8f10c1ef2f9bf0fcb25333c55d8904ff
Instruction ID: 5ce32c48e7da1add87da0dfbab0d1a93332978262382bfb2eddf012ac188ae41
Opcode Fuzzy Hash: 6fe3ca039ad29bc2c7d261886641ceef8f10c1ef2f9bf0fcb25333c55d8904ff
Instruction Fuzzy Hash: 9501A271500601ABD210DF1ACC86B66FBE8FB88B20F14811AED089BB41E771F916CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0142AAAA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0142AADC

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0ead420f26f77b1d37920fe9d2a4a8d13427294788dd0f0b4db66fe5822a1c0e
Instruction ID: 9e6e98b21aa2a00fa7dd7cf9a271bc150eec5d1c38b90165caa1096a940b375a
Opcode Fuzzy Hash: 0ead420f26f77b1d37920fe9d2a4a8d13427294788dd0f0b4db66fe5822a1c0e
Instruction Fuzzy Hash: C201A2719002408FDB10CF19E984766FBE4EF04621F18C4ABDD488F756E3B5A488CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0142A6A6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0142A6D8

Memory Dump Source

Source File: 0000000B.00000002.172700160098.000000000142A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_142a000_TDService.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 653a41765f8252afe1e47c488c73ef682471a630042dd08f936cf25577dc1b9f
Instruction ID: 5533403473dc2f8e13e724b449e075aeaf2a9af017fdb33b1e78ea1239c026a4
Opcode Fuzzy Hash: 653a41765f8252afe1e47c488c73ef682471a630042dd08f936cf25577dc1b9f
Instruction Fuzzy Hash: 2DF0A4354006448FDB208F19E985761FBE4DF44625F58C09BDD494B766D3B5E488CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 015906F0 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

20l, xrefs: 01590723

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: 20l
API String ID: 0-2549230344
Opcode ID: e090b293f0aae0b2b846d9d6a30e9df80ea65d9c0ffdc4214791bffd2243cea5
Instruction ID: 158ba4bf9717ed87d6066c651de3b2b2d1973b352e8e935ac9898ad16fe72226
Opcode Fuzzy Hash: e090b293f0aae0b2b846d9d6a30e9df80ea65d9c0ffdc4214791bffd2243cea5
Instruction Fuzzy Hash: B8F0C8307143444FC714973594546FF7BAAAFCA218754457FD44ACBB91CE3A8C0B8791

Uniqueness

Uniqueness Score: -1.00%

Function 01590700 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

20l, xrefs: 01590723

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID: 20l
API String ID: 0-2549230344
Opcode ID: 177759e599d68de868a1734cb9c2d461e5a7aa8491b3c0fd01969d71e0db4fce
Instruction ID: 40af5c621195494fe85363b305d8cf595b6f58aaa1a0523fb65f938701829877
Opcode Fuzzy Hash: 177759e599d68de868a1734cb9c2d461e5a7aa8491b3c0fd01969d71e0db4fce
Instruction Fuzzy Hash: 36F0A7317003184BC318A67BD494AEB769BABC9218B50443ED54ECBB40CF76DC0A8795

Uniqueness

Uniqueness Score: -1.00%

Function 015903AD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3793c8cb945c2e42f4fde497bde6e2ebd10aeb72c8c0fe806fa6772bf9642585
Instruction ID: e4352d4260402f799d44074b82db894fe456b40b5f03e57200a1d6956af3164d
Opcode Fuzzy Hash: 3793c8cb945c2e42f4fde497bde6e2ebd10aeb72c8c0fe806fa6772bf9642585
Instruction Fuzzy Hash: 9431C334201300CFC728EB34E4506AA73A7FFC5218B14896EC59A8B3A5EF39AC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 015903C8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654dc1742560e87a19231073610d9b096abbda76eef15a3276cb3f7892d3a630
Instruction ID: c668c41d6dd1f803aaab9daa5acc3c4ef1911459f6c09deca89dd9ff0295c0a6
Opcode Fuzzy Hash: 654dc1742560e87a19231073610d9b096abbda76eef15a3276cb3f7892d3a630
Instruction Fuzzy Hash: A7317F35201614CFC728EB34E5606AAB3E7BFC5258B158C2DD55A8B394EF39EC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 014B05E2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fad4b44dbe46480f0c84c9aa2d60288b06a9b89254be2dcdd0673cd822445d
Instruction ID: f44294ad757e79489f59088c5262f94ae25522315f17cb674b3066b3ef14ead9
Opcode Fuzzy Hash: f8fad4b44dbe46480f0c84c9aa2d60288b06a9b89254be2dcdd0673cd822445d
Instruction Fuzzy Hash: 9F01DDB650D7C05FD712CB159C50863FFF8DB86620709C4DFE84987652D165A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 014B0C5B Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed18fd2a1063584a2ca2b1e887a26f6a57d305e9b04a9490251a9a72722d82f4
Instruction ID: e4010935b3a2af7e473e08cdceff0e913e44dee60cdd37c48d1038429a01e299
Opcode Fuzzy Hash: ed18fd2a1063584a2ca2b1e887a26f6a57d305e9b04a9490251a9a72722d82f4
Instruction Fuzzy Hash: 4A216D711493C49FC707CB20C890B96BFB1AB46204F1985EFD4848F6A3C33A9817DB61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0C94 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d9a20638232783a290ae76b4fc4492c57f394dbb2ace37fd05a8f10cccfe07
Instruction ID: 6b76da81ee46458530e0da7612b273be7649575b74afe1d9d9a529f41a225b04
Opcode Fuzzy Hash: c4d9a20638232783a290ae76b4fc4492c57f394dbb2ace37fd05a8f10cccfe07
Instruction Fuzzy Hash: F211D2302042849FD715CB18D580B6BBBF5EB88709F24C99EE9490B7A3C777D817CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014B0DEC Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac0a3ef7c0c0f315467e64550ce095277c8a1fa7396428edc722c022880687d
Instruction ID: 8ccf47180f2062337669110174e80bdb06b5aa7c0e42184a8966a371f65ac902
Opcode Fuzzy Hash: cac0a3ef7c0c0f315467e64550ce095277c8a1fa7396428edc722c022880687d
Instruction Fuzzy Hash: C6112630204280DFD311CB18D4C0B67F7B5AB84719F24C59EE8490BB62C77BD807C661

Uniqueness

Uniqueness Score: -1.00%

Function 01590629 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d107e0dc5f7007dc273056a6e5bb2a6c3cefa5e9520745e248b22ecfa978aaa
Instruction ID: a661d8232b3b1e99d86ce043fd280fcde8bf015d1f94e8a2bda5cf22ebf7423b
Opcode Fuzzy Hash: 0d107e0dc5f7007dc273056a6e5bb2a6c3cefa5e9520745e248b22ecfa978aaa
Instruction Fuzzy Hash: 2E11C2313003548FD72A673080107AF7762ABD2758F15887EC9469F792CEBADC46DB95

Uniqueness

Uniqueness Score: -1.00%

Function 01590638 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463dc0067d87e92675993f1d8d1689f777548d5b6a1fa07d48b23e7a0eee12a8
Instruction ID: d6be6e472531d4533ba6c6cfc86122d859e66e74831149bdc5f0c6bedbbdefde
Opcode Fuzzy Hash: 463dc0067d87e92675993f1d8d1689f777548d5b6a1fa07d48b23e7a0eee12a8
Instruction Fuzzy Hash: 300180313003288BD7196731C010B9F7256ABD1758F14893EC9469F785CEBADC86DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 014B0DAA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffe88e7eca7b1de068a50569141a62928939a82c6ab0fb05efb9e3636e5b14d
Instruction ID: 1ba00593d6d4e6e6cc8f7a28ff582209fcdda6f25580905f21ae512dc282ce8a
Opcode Fuzzy Hash: cffe88e7eca7b1de068a50569141a62928939a82c6ab0fb05efb9e3636e5b14d
Instruction Fuzzy Hash: D011823010C7808FC3078B54C994B5AFFB5AB4A314F1485DFE5894B6A3C336A813CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014B0DD4 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125392c993ede1c91cefadc9523ac5077eb6d5d53de9f24be2b0cf4563af261e
Instruction ID: 706d3e62995b0e3deb70c173aa48fec09efca228c38003d74e91a66a276457ea
Opcode Fuzzy Hash: 125392c993ede1c91cefadc9523ac5077eb6d5d53de9f24be2b0cf4563af261e
Instruction Fuzzy Hash: 64116134549380CFD716CF14D590B52BBB1AB96714F28C6EEE8494FBA3C37A980ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 014B0D50 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1b55af5a3511b148ba601d18101a128fa281466cd52ee823f89a24abc4b3f4
Instruction ID: 2b5b5e045e2b2b50008ff9144d535cf39f005fe2f5f5d5fac6a64d99fce4ad93
Opcode Fuzzy Hash: bb1b55af5a3511b148ba601d18101a128fa281466cd52ee823f89a24abc4b3f4
Instruction Fuzzy Hash: E1F06D35104644DFC306CF04D580B16FBB2EB88718F24CAADE8480B762C337E813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 014B0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe3f307d9bd17f5fbc64e2bf19f8c98cf4f3de3c9b6637c486e73628fbcabe8
Instruction ID: 58da4c43a57ceac57940e32c7d37c346ec9e07f3c586ae05db69c7c291c646d2
Opcode Fuzzy Hash: dbe3f307d9bd17f5fbc64e2bf19f8c98cf4f3de3c9b6637c486e73628fbcabe8
Instruction Fuzzy Hash: 5FF04F35144640DFC316CF04D580B56F7A2FB95714F24C6AEE8480BB62C7379813CA91

Uniqueness

Uniqueness Score: -1.00%

Function 0159014F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad642aab16f3e55e107e64ca64fffea248f10f9eddcba2e9b3c93ca1790395c
Instruction ID: fb88433c51977a3e845bb6832bfa6bca1669c81f070769485b97e719b4a1b98a
Opcode Fuzzy Hash: 8ad642aab16f3e55e107e64ca64fffea248f10f9eddcba2e9b3c93ca1790395c
Instruction Fuzzy Hash: 3AE022317043602FCB0973B528204FE3BA79FD6278B18087FC249C7692EE2D4C068712

Uniqueness

Uniqueness Score: -1.00%

Function 014B0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701261620.00000000014B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_14b0000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb144900f0c94aac9708fc92ac41468ba77badcf70e852747903d75242007b8
Instruction ID: bb7b513ff06459c391a8ded6f3bd27b6bd001a3b9797e085322df40abc462b04
Opcode Fuzzy Hash: 7cb144900f0c94aac9708fc92ac41468ba77badcf70e852747903d75242007b8
Instruction Fuzzy Hash: 1BE092B66006044BD650CF0AEC81462F7D8EB84630708C07FDC0D8B701E275B508CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 015905E7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74be40921cc83ba327a32e4a34e510d7a340afa3e6b953b82b136bd91aee79a2
Instruction ID: 562e9434a8cf197d673a52c1a00f2e75dfb11681ac21966b45747124fce030e1
Opcode Fuzzy Hash: 74be40921cc83ba327a32e4a34e510d7a340afa3e6b953b82b136bd91aee79a2
Instruction Fuzzy Hash: FDE09A341893408FC3198B30A0501A17BB6EB86319B2486AFD88A8B357C63FDC07CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01590160 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d1d274bc5400f01e08694a57884665e1aa025cde659449706befae4bf04e3d
Instruction ID: 2c8854b5d54adf6910617bdf4c2bcf93ac9cf49f1cfd528e2f0c05a0f3b8c348
Opcode Fuzzy Hash: e9d1d274bc5400f01e08694a57884665e1aa025cde659449706befae4bf04e3d
Instruction Fuzzy Hash: D3D05B16700135134A08727B54619BF258F9BDA574718443BD60DC7790DD694C0543A1

Uniqueness

Uniqueness Score: -1.00%

Function 015905F8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172701584653.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1590000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb93b92f820aff4c6c7a80cde236896bd6e067a2d1246b06fb99af1db89fbc9
Instruction ID: efe7533ae2d48bffb7f09992664b9e2ed3f1d635cd29fd870e0923466b3fa17f
Opcode Fuzzy Hash: 5fb93b92f820aff4c6c7a80cde236896bd6e067a2d1246b06fb99af1db89fbc9
Instruction Fuzzy Hash: AFD0A7301013048BC3249734E000642739AFB8531DF10487ED50A4B345CB7BEC41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 014223F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172700093552.0000000001422000.00000040.00000800.00020000.00000000.sdmp, Offset: 01422000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1422000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc3ad2afc67725acaddd0b1d959d9968bde5d8d072318a4b609613ca730a7cc
Instruction ID: 947cd5e1eabddcb7cf4381bc6d0a2bea54678a10eb1ff114624eec5f1f1c3df3
Opcode Fuzzy Hash: edc3ad2afc67725acaddd0b1d959d9968bde5d8d072318a4b609613ca730a7cc
Instruction Fuzzy Hash: CCD05E792056E14FE316DA1CC2A4F963BE4AB55714F8A44FAEC009BB73C7A8D5C1D610

Uniqueness

Uniqueness Score: -1.00%

Function 014223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.172700093552.0000000001422000.00000040.00000800.00020000.00000000.sdmp, Offset: 01422000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1422000_TDService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a0b0605cd571f91429c562259993b8a159af254aee62b19eb658790e1ede
Instruction ID: e34a35fc567cb1747446411744c7f79d987ca823cae27efdde653fe29dab416f
Opcode Fuzzy Hash: abe8a0b0605cd571f91429c562259993b8a159af254aee62b19eb658790e1ede
Instruction Fuzzy Hash: C8D05E342002814BD719DA1CC2D4F5A7BD4AF40714F0644E9AC10CB772C7B4D8C0CA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TechkonDriver64Bit.exePID: 5720, Parent PID: 3060COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1815
Total number of Limit Nodes:	105

Executed Functions

Function 6A15AE70 Relevance: 20.6, APIs: 1, Strings: 10, Instructions: 1392COMMON

Download Yara Rule

APIs

Part of subcall function 6A1607D0: CharUpperW.USER32(?,00000000,?,6A15FCF3,?,6A15FE6C,?,00000000,?,00000010,ED279CBA,?,00000000,00000000), ref: 6A1607F7
Part of subcall function 6A1607D0: CharUpperW.USER32(?,?,6A15FE6C,?,00000000,?,00000010,ED279CBA,?,00000000,00000000), ref: 6A160804

VariantClear.OLEAUT32(?), ref: 6A15BEEE

Strings

iso, xrefs: 6A15B996
!, xrefs: 6A15B89D
Unknown error, xrefs: 6A15BEB2, 6A15BEB7
exe, xrefs: 6A15B192
udf, xrefs: 6A15BA33
rar, xrefs: 6A15B8F8
001, xrefs: 6A15B76A
R, xrefs: 6A15B891
r, xrefs: 6A15B899
a, xrefs: 6A15B895

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CharUpper$ClearVariant
String ID: !$001$R$Unknown error$a$exe$iso$r$rar$udf
API String ID: 3047578428-2136912355
Opcode ID: 173c09885f63b77b8abac5a7531e21ff729e982be533c18273a03c4200ff01d6
Instruction ID: a1e75fa7c0eb22d6babcb81262aa67afa627a2494513864f78d4aae82dd4a4ee
Opcode Fuzzy Hash: 173c09885f63b77b8abac5a7531e21ff729e982be533c18273a03c4200ff01d6
Instruction Fuzzy Hash: C9C28DB59052288FCB24DF28CC84BDEB7B5AF49314F1141D9D959AB342EB31AE91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A1635F0 Relevance: 13.0, APIs: 8, Instructions: 979COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6A1637C4
GetLastError.KERNEL32(?), ref: 6A1637D1

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseErrorFindLast
String ID:
API String ID: 754982922-0
Opcode ID: eaaa8410b9e2f3fb74eab85bfd1890f0a8e56f0e03c32d857cb01b67bb9a2dc3
Instruction ID: 54ba162d3e04e3d079c89e97bd76df866182695c8e5924d8bef3126b68515991
Opcode Fuzzy Hash: eaaa8410b9e2f3fb74eab85bfd1890f0a8e56f0e03c32d857cb01b67bb9a2dc3
Instruction Fuzzy Hash: A382DFB16083409FD724CF28C484B9BB7E5EF89318F155A1DF99A97381DB30E855CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A172A30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122
libraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 6A172B20
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 6A172B3C
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 6A172B48
FindResourceW.KERNEL32(6A150000,00000068,RC_DATA), ref: 6A172B7E
LoadLibraryW.KERNEL32(?,?), ref: 6A172BA7

Strings

RC_DATA, xrefs: 6A172B76
7z.dll, xrefs: 6A172AAC

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$LibraryLoad$CloseFileFirstResource
String ID: 7z.dll$RC_DATA
API String ID: 2112305928-3209790242
Opcode ID: ac01307017e778d9032818e6ec69721bc9138bb1566e040f0ab916c73a3fd514
Instruction ID: f07cdbc496d0275bc2555874dc0786f8ceda566e176cd40cc059162cb6f21279
Opcode Fuzzy Hash: ac01307017e778d9032818e6ec69721bc9138bb1566e040f0ab916c73a3fd514
Instruction Fuzzy Hash: DC41E2B15083409FC720EF24C948B5BB7E8AF9A358F050A5DF95697281DF34E909CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6A158AB0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(FFFFFFFF,?), ref: 6A158BF9
FindClose.KERNEL32(FFFFFFFF,?), ref: 6A158EA0

Part of subcall function 6A17663B: RaiseException.KERNEL32(?,6A170629,ED279CBA,?,?,6A170629,?,6A188388,ED279CBA), ref: 6A17667D

Strings

rar, xrefs: 6A1590BC
001, xrefs: 6A159003

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseFind$ExceptionRaise
String ID: 001$rar
API String ID: 1045303971-402399766
Opcode ID: 568d7b227f1e04c7bb564895fe66a6fd3261ec7e550e17d775f20b4477a01aa7
Instruction ID: 7a9bfd4f0ea3553062f213f7a2dc49d60f9ff3e8c3552b6581df3b13d4c748b5
Opcode Fuzzy Hash: 568d7b227f1e04c7bb564895fe66a6fd3261ec7e550e17d775f20b4477a01aa7
Instruction Fuzzy Hash: BD9257B55083819FC324DF68C880A9BFBE5BF89314F518A1DE5AA87341DB31E855CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6A162470 Relevance: 4.6, APIs: 3, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(?,ED279CBA,6A180658,00000000), ref: 6A1624C4
FindFirstFileW.KERNEL32(6A1850B8,?,ED279CBA,6A180658,00000000), ref: 6A1624DE
FindFirstFileW.KERNEL32(?,?), ref: 6A16253A

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: 71f81366787c223f23f2e4cc1143b4d5d66f8e94aad1eaa54c18af519ba5ac1b
Instruction ID: 2c2de15d53694269007f6791ddb968e8856ef1dd685acb21bfdcedad82e27f16
Opcode Fuzzy Hash: 71f81366787c223f23f2e4cc1143b4d5d66f8e94aad1eaa54c18af519ba5ac1b
Instruction Fuzzy Hash: C63181B19083519FC720DF24C848BAAB7E4FF59324F110B59E8A9D32C0EB35A915CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A164C00 Relevance: 2.1, APIs: 1, Instructions: 589COMMON

Download Yara Rule

APIs

Part of subcall function 6A162470: FindClose.KERNEL32(?,ED279CBA,6A180658,00000000), ref: 6A1624C4
Part of subcall function 6A162470: FindFirstFileW.KERNEL32(6A1850B8,?,ED279CBA,6A180658,00000000), ref: 6A1624DE
Part of subcall function 6A162470: FindFirstFileW.KERNEL32(?,?), ref: 6A16253A

FindClose.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 6A164CE0

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6c016b42bbdc7711d62f42caaf17af93eeb09ddd860e6937c74148fbbb641272
Instruction ID: eba5952084be446debc8c3a1480c20be6b8ee3dc0e45ee380689cd3ab14d33ff
Opcode Fuzzy Hash: 6c016b42bbdc7711d62f42caaf17af93eeb09ddd860e6937c74148fbbb641272
Instruction Fuzzy Hash: 773267B15083808FC320CF68C880A9BF7E4BFD9314F159A2EE99997351DB71E955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10004859 Relevance: 28.9, APIs: 15, Strings: 1, Instructions: 904COMMON

Download Yara Rule

APIs

Part of subcall function 10017690: InitializeCriticalSection.KERNEL32 ref: 100176BE

DeleteCriticalSection.KERNEL32(?), ref: 10004A99
SysFreeString.OLEAUT32(?), ref: 10004D73
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004E67
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004ED2
DeleteCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 10004F2E
DeleteCriticalSection.KERNEL32(?), ref: 10005080
DeleteCriticalSection.KERNEL32(?), ref: 100050D7
DeleteCriticalSection.KERNEL32(?), ref: 10005131
DeleteCriticalSection.KERNEL32(?), ref: 1000519C
SysFreeString.OLEAUT32(?), ref: 100051C5
DeleteCriticalSection.KERNEL32(?), ref: 10005201
SysFreeString.OLEAUT32(?), ref: 10005238
DeleteCriticalSection.KERNEL32(?), ref: 10005274
DeleteCriticalSection.KERNEL32(?), ref: 100052EC
DeleteCriticalSection.KERNEL32(?), ref: 1000537C

Strings

*, xrefs: 100053D3

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$Delete$FreeString$Initialize
String ID: *
API String ID: 858148593-163128923
Opcode ID: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
Instruction ID: ecb8a8915c69c7c96d6c908040f4422d87eeaffb21051c4ea884642e96cadca4
Opcode Fuzzy Hash: 8d515e06e490fc0e037fbab827e854e363c9577b9e0b0373954554861fc9b88c
Instruction Fuzzy Hash: C3926B74900289DFEF04CFA4C884ADDBBB5FF19344F21849CE446AB256CB71AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1001A421 Relevance: 9.1, APIs: 6, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A459
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A464
HeapFree.KERNEL32(00000000,?,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A471
HeapFree.KERNEL32(00000000,?,?,?,?,10019FC1,1001A015,?,?,?), ref: 1001A48D
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,10019FC1,1001A015,?,?,?), ref: 1001A4AE
HeapDestroy.KERNELBASE(?,?,10019FC1,1001A015,?,?,?), ref: 1001A4C0

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction ID: 1c740d521b0f7e213dbb02f6402200852ca7cbed31c7f2444751ff5461a08e8a
Opcode Fuzzy Hash: a134391120f2aacd7473546f5f7e68fbc99744a2b02380d7265d2bcfbbc009a3
Instruction Fuzzy Hash: 5A110035240365BBE661EB10DCCAF05B7A6E785750F314026FA456A571C7B2BCA2CB14

Uniqueness

Uniqueness Score: -1.00%

Function 6A1542E0 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharUpperW.USER32(?), ref: 6A154943

Part of subcall function 6A17663B: RaiseException.KERNEL32(?,6A170629,ED279CBA,?,?,6A170629,?,6A188388,ED279CBA), ref: 6A17667D

Strings

Incorrect command line, xrefs: 6A15431B, 6A15433E, 6A15454F, 6A154579, 6A1548F9
Cannot use absolute pathnames for this command, xrefs: 6A154521

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CharExceptionRaiseUpper
String ID: Cannot use absolute pathnames for this command$Incorrect command line
API String ID: 1023082840-724315024
Opcode ID: 57392e80117517ef09de0f633658104c77385836267872f1e280281a3d9a8e45
Instruction ID: f2913436fd155fa05c0e1fe32e8453754bd1ccfd7b8adb8e4f1b193932e544c1
Opcode Fuzzy Hash: 57392e80117517ef09de0f633658104c77385836267872f1e280281a3d9a8e45
Instruction Fuzzy Hash: 8122D9B15083409FD711CF14C484B9ABBE6BF95308F09899CE4F94B392DB74E965CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A162A70 Relevance: 4.6, APIs: 3, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,ED279CBA,?,00000000,?,?,00000000,?,?,?,00000000,6A180C38,000000FF), ref: 6A162A9F
CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,ED279CBA,?,00000000,?,?,00000000), ref: 6A162ACC
CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6A162B2B

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateFile$CloseHandle
String ID:
API String ID: 1443461169-0
Opcode ID: b41c809410920ddc5026452ff5b2c1d0fa8bac8c94313f909c53663d0eba9fdf
Instruction ID: 28b4aec2271fc3d6ecb6f192dc2b9fe66a72dc219d9e5eb062adafd463d9783f
Opcode Fuzzy Hash: b41c809410920ddc5026452ff5b2c1d0fa8bac8c94313f909c53663d0eba9fdf
Instruction Fuzzy Hash: 6F315CB5A00219AFDB10CF64D845BABBBB8FB05764F104719FC25E72C0DB71AA11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A161340 Relevance: 4.6, APIs: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,ED279CBA,?,?,?,?,?,00000000), ref: 6A16136E
GetLastError.KERNEL32 ref: 6A16138C
CreateDirectoryW.KERNEL32(?,00000000), ref: 6A1613D7

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 7ae9976ff1a2d097298dd3b3e6dd515c80898a2c2a8f2b97dc02e75a04cced6f
Instruction ID: 567eec0d554d9f84bc78a614fcd2bc121003a859b4c8e89ce57fb1554ed3990f
Opcode Fuzzy Hash: 7ae9976ff1a2d097298dd3b3e6dd515c80898a2c2a8f2b97dc02e75a04cced6f
Instruction Fuzzy Hash: E9210073E04204ABDB10DF98D805BAFFBB8EB46625F11016AED05E3280DF365905C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6A151AB0 Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 6A151AEC
GetLastError.KERNEL32 ref: 6A151B01

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 268d957b9990d43df9c06f5a4fb55db687ee574060676f733222a5b5c9b09758
Instruction ID: b310de93342337385a5b6a5e62b0fa2ba1e6601a619a1c284db9a2f2bf6b560c
Opcode Fuzzy Hash: 268d957b9990d43df9c06f5a4fb55db687ee574060676f733222a5b5c9b09758
Instruction Fuzzy Hash: 00110BB77051094B8700DE6CE9409ABB7E4EB95321F00822EFD28C7250E732D42597F1

Uniqueness

Uniqueness Score: -1.00%

Function 6A158670 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,?,00000000), ref: 6A158916

Strings

<H, xrefs: 6A15896F

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast
String ID: <H
API String ID: 1452528299-4022674625
Opcode ID: e9da1ac345df53c9dd1519e6a4210cfb08c52a471f3c50206f25b9db1cf830ad
Instruction ID: 2373c3bd3826a369ea99420419901dc99db24ece927370fba2902db55918e131
Opcode Fuzzy Hash: e9da1ac345df53c9dd1519e6a4210cfb08c52a471f3c50206f25b9db1cf830ad
Instruction Fuzzy Hash: F3E1A1F5D00248AFCB04DFE8C8849DEBBB5FF49314F24815DE516AB241DB34AA55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A176360 Relevance: 3.1, APIs: 2, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6A1793E1: HeapCreate.KERNEL32(00000000,00001000,00000000,?,6A176375,00000001,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9), ref: 6A1793F6

GetCommandLineA.KERNEL32(?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A176396

Part of subcall function 6A17A76A: GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6A17A788
Part of subcall function 6A17A76A: GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6A17A7C3

Part of subcall function 6A177C8C: GetStartupInfoA.KERNEL32(?), ref: 6A177CA1
Part of subcall function 6A177C8C: GetFileType.KERNEL32(00000040,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177DCB

Part of subcall function 6A17711E: TlsFree.KERNEL32(00000015,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177149
Part of subcall function 6A17711E: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A1780C0
Part of subcall function 6A17711E: DeleteCriticalSection.KERNEL32(00000015,?,?,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A1780EA

Part of subcall function 6A1770EA: TlsGetValue.KERNEL32(6A15FA7E,6A177259,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF,?,6A15FA7E,?), ref: 6A1770F3
Part of subcall function 6A1770EA: TlsSetValue.KERNEL32(00000000,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF,?,6A15FA7E,?), ref: 6A177114

Part of subcall function 6A177653: Sleep.KERNEL32(00000000,?,6A15FA7E,?), ref: 6A17767B

GetCurrentThreadId.KERNEL32 ref: 6A176466

Part of subcall function 6A175FF4: HeapFree.KERNEL32(00000000,6A15FA7E,6A187EB0,0000000C,6A1781B5,00000000,6A188028,0000000C,6A1781EF,6A15FA7E,?,?,6A17C6AB,00000004,6A1882E8,0000000C), ref: 6A17605C
Part of subcall function 6A175FF4: GetLastError.KERNEL32(?,6A17C6AB,00000004,6A1882E8,0000000C,6A177669,6A15FA7E,?,00000000,00000000,00000000,?,6A17726D,00000001,00000214), ref: 6A17606D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalDeleteEnvironmentFreeHeapSectionStringsValue$CommandCreateCurrentErrorFileInfoLastLineSleepStartupThreadType
String ID:
API String ID: 3748246414-0
Opcode ID: b45c563d43ad9dfc0bdfb2652cbf759bc3c52389d5dbe814a39b02c44b1e79e9
Instruction ID: d773ce0600cb217a76a7f815c41bec779779c83b3d15883f08a312fd3f076ede
Opcode Fuzzy Hash: b45c563d43ad9dfc0bdfb2652cbf759bc3c52389d5dbe814a39b02c44b1e79e9
Instruction Fuzzy Hash: 2421D33158836A9AE77167B54C4C60A36F4EF57769B237827E47AC2043FF21C441CABA

Uniqueness

Uniqueness Score: -1.00%

Function 6A161060 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,ED279CBA,?,00000000,?,?,00000000,?,ED279CBA,00000000), ref: 6A16108F
SetFileAttributesW.KERNEL32(?,00000000), ref: 6A1610ED

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 90bebf0c973f86125aa5b8af65e223d951fadc19cc84945e17019df837bbbd4d
Instruction ID: 2a05cc78a5b1b654f711d49e7acda01c2e9208000aa7312a9dc3217dd6eb33b4
Opcode Fuzzy Hash: 90bebf0c973f86125aa5b8af65e223d951fadc19cc84945e17019df837bbbd4d
Instruction Fuzzy Hash: 5F21C177E04208ABDF00CFA4D845B9EFBF8EB45665F01016AED08D3340EB36AA05C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 10019CB8 Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction ID: 578384fe474d0b562f95e97df9c8fae57dcf2a9e42d60c7228f8a9f52e2ea293
Opcode Fuzzy Hash: 53b11fc37b3e5cb832321f1eb73cf4aff9b5aac8ba68efd3095b3517519951be
Instruction Fuzzy Hash: 77F028372043156BDB21DF65EC05DAF3BA5DF446B0B104029FA18CA190CB31D8918B91

Uniqueness

Uniqueness Score: -1.00%

Function 6A151C20 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6A151C4C
GetLastError.KERNEL32 ref: 6A151C75

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 63ffb4cebd8dfcc49da1a063671e578e87392d4bc1c7cf49421b0ce43a4ea51a
Instruction ID: d4afe5ea1b12bea7fe4d6f914aabf0d0bc78716a6adb3fffc43c8c5c49d7a5d4
Opcode Fuzzy Hash: 63ffb4cebd8dfcc49da1a063671e578e87392d4bc1c7cf49421b0ce43a4ea51a
Instruction Fuzzy Hash: 4601867220030A9FD750DE58D844BA737E8BF55750F00492AF926CB580D776EC618BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6A1519C0 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 6A1519EB
GetLastError.KERNEL32 ref: 6A151A0C

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: ca500aa0c9c7826d2c3c1097ed16826d044c52d8ae5bc097d3cbf395f7443254
Instruction ID: 28f1871d257e112e89616f776a31932aff7f643a967f6304bf546a0b95b17376
Opcode Fuzzy Hash: ca500aa0c9c7826d2c3c1097ed16826d044c52d8ae5bc097d3cbf395f7443254
Instruction Fuzzy Hash: 50F062B535024A9BDB05DE54D854B6B33E9BB94310F04C52AF969CB280DB75D831DB70

Uniqueness

Uniqueness Score: -1.00%

Function 1001A3C4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10019F1B,00000001), ref: 1001A3D5

Part of subcall function 1001A27C: GetVersionExA.KERNEL32 ref: 1001A29B

HeapDestroy.KERNEL32 ref: 1001A414

Part of subcall function 1001A4C9: HeapAlloc.KERNEL32(00000000,00000140,1001A3FD,000003F8), ref: 1001A4D6

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction ID: f49a4552e00520ddd5bd994c2c6f56530b3037705a70c7491d35245aff95e9ec
Opcode Fuzzy Hash: bc4e9ed2508816d106b6c68f37e2140fc1a3498347a5ba50f7c2e7f5e8612b28
Instruction Fuzzy Hash: 80F09274611302ABFF14EB309D8AB5935D1DB86791F308436F905CD0A6EBF0D8D2A611

Uniqueness

Uniqueness Score: -1.00%

Function 6A151BE0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000002,6A16B356,?,?,?,?,?,?,6A185380,?), ref: 6A151BE9
GetLastError.KERNEL32(?,?,?,?,?,?,6A185380,?), ref: 6A151BFD

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: ad48640506d675cb2f471392114b64fafbe2ed61a6b78879ff0dfac5bbe288ef
Instruction ID: 4f8153d7cd67c31a26f50bb4edd5afb60950352f3163923e6e8240ac3fc77b43
Opcode Fuzzy Hash: ad48640506d675cb2f471392114b64fafbe2ed61a6b78879ff0dfac5bbe288ef
Instruction Fuzzy Hash: 94E012F83506035ADB115E35CD4832675E46B137717A18B28E07AC54E0EF2EC4528A24

Uniqueness

Uniqueness Score: -1.00%

Function 10002805 Relevance: 2.5, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000281B
LeaveCriticalSection.KERNEL32(00000000,?,?,?,10002894,?,?,?,?,?), ref: 1000284F

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction ID: a3f251eb98acb8aeedd518acfd2e06878d0524bbd79d22e0378b99734f5e22aa
Opcode Fuzzy Hash: 31ba921f93e0922ecbc56fece5b0bbad6d7110b5eb9d49f18265bee903e4b92a
Instruction Fuzzy Hash: D401467AA00214AFDB11CF94C848B9ABBB9FF48711F10841AFD01A7221C7B4A9119B60

Uniqueness

Uniqueness Score: -1.00%

Function 6A157350 Relevance: 1.7, APIs: 1, Instructions: 158timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000,ED279CBA,?,?,?,?,?,6A180300,000000FF), ref: 6A157438

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 4f3ef1e32210bcaeef50482b2b128431856e597fb46236b39182963be840a039
Instruction ID: dda01446917dfc335b9e833ef4fb99be06b767b3d7a422d7e570ef289ac87469
Opcode Fuzzy Hash: 4f3ef1e32210bcaeef50482b2b128431856e597fb46236b39182963be840a039
Instruction Fuzzy Hash: 4C518DB2A04A82BFD759CF74C481BA5FBA0FB49314F158A6ED47D87601DB31B864CB90

Uniqueness

Uniqueness Score: -1.00%

Function 100188B8 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1001899F

Part of subcall function 1001A13A: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10018A6D,00000009,?,?,?), ref: 1001A177
Part of subcall function 1001A13A: EnterCriticalSection.KERNEL32(?,?,?,10018A6D,00000009,?,?,?), ref: 1001A192

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction ID: bde266228d008e092059639ff97bb6b14f601e90ad82446575358dbeed7d10ff
Opcode Fuzzy Hash: 64ac742c6e18b1ebf1a9d12a1be87a2e2d80d958cc1a171f76a8005aa0769b83
Instruction Fuzzy Hash: C5219032A00255BAEB10DB68DC42BADB7A4FB01764F284215F924EF1C0C774EBC18B52

Uniqueness

Uniqueness Score: -1.00%

Function 6A175F2A Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6A15FA6F,?,00000000,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF), ref: 6A175FA1

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c524c3d35e129a379a1f49c2a8da8e1cc627a0a0235f07edb0f585804db5283c
Instruction ID: ff657bc221d36583a9b33441c36328ac186ac5559f397642aee088e634f37313
Opcode Fuzzy Hash: c524c3d35e129a379a1f49c2a8da8e1cc627a0a0235f07edb0f585804db5283c
Instruction Fuzzy Hash: 6611C4326497256AD7712A28CC14B5AB7A8DF13778F672526F820EF1D1DF70DC8086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6A161420 Relevance: 1.6, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6A15890F,ED279CBA,?,?,00000000), ref: 6A161528

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3c32191c75af88f9d1fe08f30b4bbe96fd63228db39d6f7f2eaf7ca1fa63d4dd
Instruction ID: 5b6515359f9918a77759a5957f214ca5049366259302a9f09e5b77855f6754f5
Opcode Fuzzy Hash: 3c32191c75af88f9d1fe08f30b4bbe96fd63228db39d6f7f2eaf7ca1fa63d4dd
Instruction Fuzzy Hash: B1B10476E002088BCF10DFA8D984AEEB7B4FF54314F195169D902E7341EF71AA25CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A1625A0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6A162470: FindClose.KERNEL32(?,ED279CBA,6A180658,00000000), ref: 6A1624C4
Part of subcall function 6A162470: FindFirstFileW.KERNEL32(6A1850B8,?,ED279CBA,6A180658,00000000), ref: 6A1624DE
Part of subcall function 6A162470: FindFirstFileW.KERNEL32(?,?), ref: 6A16253A

FindClose.KERNEL32(FFFFFFFF,?,ED279CBA,?,00000000,6A1850B8,?,6A180438,000000FF,?,6A16265E), ref: 6A1625EA

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 55de221b9e115a7bc516763f8cc9a0d9396011898998628e0dacb5f826b4a603
Instruction ID: abe75a7fd8da43622bba5a8c5952012bc7e4f7f9d90476fbff46767bf2d378ea
Opcode Fuzzy Hash: 55de221b9e115a7bc516763f8cc9a0d9396011898998628e0dacb5f826b4a603
Instruction Fuzzy Hash: D1F01DB6944648AFC710CF98C844FAAF7B8FB16624F50475AF831D37C0DB3569058A64

Uniqueness

Uniqueness Score: -1.00%

Function 6A151950 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 6A15196C

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bb8fa47d577f3c5aa614f202210f46666a550609756abe0a7f685358c434c654
Instruction ID: d5efbab00efc2a38aead9588cd3aea003f77d24fa086fd320b82170b001441ae
Opcode Fuzzy Hash: bb8fa47d577f3c5aa614f202210f46666a550609756abe0a7f685358c434c654
Instruction Fuzzy Hash: 83E0DFF020071057C3116E699804B4ABBCC9F133B0B11CB28E8B9D72C0DF74E411CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A1793E1 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6A176375,00000001,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9), ref: 6A1793F6

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 188ec095adf61b98999a2a735bc016124edc54f0bed82065c677ca406cad6ac2
Instruction ID: b791ca0abb5afd7791afa71835f2e964ded0e5d0b9a323cc51f0e4593178bc8e
Opcode Fuzzy Hash: 188ec095adf61b98999a2a735bc016124edc54f0bed82065c677ca406cad6ac2
Instruction Fuzzy Hash: CED0A7325543485EDF006EB49C08B223BDCEB87795F048435F91DC7180F770C951D640

Uniqueness

Uniqueness Score: -1.00%

Function 10019DDE Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction ID: 587474e3f6e270900c506b7264c4806e64e6eaefbf2122b89b9aa41b5ebd9e7a
Opcode Fuzzy Hash: 0fe3482dfa25c527acbd858d9d887206c278c7a8d427f86923067702572674c7
Instruction Fuzzy Hash: D6E08C3694052AABEB12E7A0CC46A9E37A0EF08380F040010F8005E062DB70FED24692

Uniqueness

Uniqueness Score: -1.00%

Function 10019DE9 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 10019E13

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction ID: 55bdce0fba70f3b5ff24939f3ea0e7f6c7887ef7bde984f872fb15fca6cc6046
Opcode Fuzzy Hash: e83cf6b22c983a4ed28e69ad6d1585a06803cfa532badbaccde98c5e56e59925
Instruction Fuzzy Hash: 4FD05E31540626ABE213E770DC86A5E2394DF05790B110115F8408D062DF70FEC24192

Uniqueness

Uniqueness Score: -1.00%

Function 6A15CAE0 Relevance: 1.5, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 6A175F2A: RtlAllocateHeap.NTDLL(00000000,6A15FA6F,?,00000000,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF), ref: 6A175FA1

GetLastError.KERNEL32(?,00000000,00000000), ref: 6A15CBD3

Part of subcall function 6A17663B: RaiseException.KERNEL32(?,6A170629,ED279CBA,?,?,6A170629,?,6A188388,ED279CBA), ref: 6A17667D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 3847173015-0
Opcode ID: 3927b700f9eba371a75bbc38601a52dfa60815cca2811090d6ad042c0738034b
Instruction ID: 29f6065a2f4d0d6f527daa687beab85a8f4af9629bf3c5609ce90060497a17b5
Opcode Fuzzy Hash: 3927b700f9eba371a75bbc38601a52dfa60815cca2811090d6ad042c0738034b
Instruction Fuzzy Hash: 49A162B1D00248EFCB04DFA8D984ADEB7B4FF48318F118569E915A7341DB35EA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 10001B4B

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction ID: d3e97598432a4a316c69c7b199a975740681d618dafaa63f0622d860b7c48d59
Opcode Fuzzy Hash: 62b61814a3264c2a0f4f706347acbeacecd619b648c4921b8ba18a43bc66cf00
Instruction Fuzzy Hash: A9C09B7490431D97DB00E7E5D9C9D8EB7FCB608204F500451E555F3141E670F94587A1

Uniqueness

Uniqueness Score: -1.00%

Function 1001C000 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A125
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A12D
Part of subcall function 1001A0CE: DeleteCriticalSection.KERNEL32 ref: 1001A135

TlsFree.KERNEL32(FFFFFFFF,10019FBC,1001A015,?,?,?), ref: 1001C010

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalDeleteSection$Free
String ID:
API String ID: 1584690612-0
Opcode ID: 3aaa27bac5001039f89fed55244ff3c97aaca533f641e9855337a23d41bd91ec
Instruction ID: 546efeec3206eed097d6fb3f9723a3f69e2227c44c0d9f166d3baed5ab6dace6
Opcode Fuzzy Hash: 3aaa27bac5001039f89fed55244ff3c97aaca533f641e9855337a23d41bd91ec
Instruction Fuzzy Hash: 97C04C74501715CAF511D7388CCA9083695F7493707F41744F1BAC60F5D774D8C38A00

Uniqueness

Uniqueness Score: -1.00%

Function 6A15C2D0 Relevance: 1.4, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6A184C28,80000000,00000001,00000003), ref: 6A15C3BC

Part of subcall function 6A175F2A: RtlAllocateHeap.NTDLL(00000000,6A15FA6F,?,00000000,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF), ref: 6A175FA1

Part of subcall function 6A17663B: RaiseException.KERNEL32(?,6A170629,ED279CBA,?,?,6A170629,?,6A188388,ED279CBA), ref: 6A17667D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocateErrorExceptionHeapLastRaise
String ID:
API String ID: 3847173015-0
Opcode ID: 8947e375aae81190cd0149e7a563a0fd22c83adb721c6471cb2f6eefacff173e
Instruction ID: 88caed18823fd782164c657614d2a12201311644e4cd0609eb185dea01cfeb4f
Opcode Fuzzy Hash: 8947e375aae81190cd0149e7a563a0fd22c83adb721c6471cb2f6eefacff173e
Instruction Fuzzy Hash: 8F41A4B1600209AFCB10CF98C884B9BBBF9EF59310F118159E96597381DF74E916CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10017570 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 10019CB8: CreateThread.KERNEL32(00000000,00000000,Function_00019D23,00000000,?,?), ref: 10019CF9
Part of subcall function 10019CB8: GetLastError.KERNEL32(?,10017589,00000000,00000000,10002FF6,00000000,00000000,00000000,?,10002FF2,?,?,?,?,10003E76,?), ref: 10019D03

GetLastError.KERNEL32 ref: 10017598

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction ID: 5da84cd6a30c0b06f2c1d8553272c344b363e72c39abfbd7409f2c23709d4e44
Opcode Fuzzy Hash: 6a6f0967b860a04a4a08b52caf4fd14ddb262ad7e1e0691d2c85b8c655ef118e
Instruction Fuzzy Hash: 2EE0ECB2254252AEF304DB648C46FA776E9EB94B81F50442DBA49CA180E6B0D944C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 10012A20 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10001E62,?,?,1000B459,?), ref: 10012A31

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction ID: 499c3da3a26d341c9e988975342de67c6826636d0b386d7712dafe969d9ecfde
Opcode Fuzzy Hash: 0101ec0f5aa2d88080453061d33e9d0ea43cdee5597a4dbf4051f6854f2c80fe
Instruction Fuzzy Hash: 18B012F07B238176FE6E87204C5BF662451A740BC7F601098F301DC0C4E7E094409015

Uniqueness

Uniqueness Score: -1.00%

Function 10012A40 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,10001E7E,?,10001E58,?,?,1000B459,?), ref: 10012A4C

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction ID: 32e2f69f7c2909d2d391187de9ef312e1eea697864ad2fb4147c7fa98b3e1f25
Opcode Fuzzy Hash: 66144b5ccae04c28c88a4e760bc3cd1d0957039cec557337da64c84822766760
Instruction Fuzzy Hash: 96B012B034230023FD78C3110D45B1611506B00741E60405C73016C4C08570E4018504

Uniqueness

Uniqueness Score: -1.00%

Function 0045D350 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.168271035554.000000000045D000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_45d000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3617e82bd60fd03c4f87f95ed51040e3e5dadaeb0a3bebd0a62139b9ab93b5fc
Instruction ID: 9da881a1668667c5f5e61f0e74ea972f87722d8f5ad42a96f98ef7bce5f6fe0a
Opcode Fuzzy Hash: 3617e82bd60fd03c4f87f95ed51040e3e5dadaeb0a3bebd0a62139b9ab93b5fc
Instruction Fuzzy Hash: B301C4B17442046BCB12EB98DC42FAB3798EB09315F108116FE04D7292DA7DD8858BBD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D404 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.168271035554.000000000045D000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0045D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_45d000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b760d498d9366e2b8c008b5068de0d1edf9298eee5e882ad9278cafc15f1fbe1
Instruction ID: 9eb0517791e028c6019ed048d3cd8418304ffda763c1f22c3199e77c15fb86ab
Opcode Fuzzy Hash: b760d498d9366e2b8c008b5068de0d1edf9298eee5e882ad9278cafc15f1fbe1
Instruction Fuzzy Hash: 9BC0026160663466562535A92CC5CEF01488D462AEB24136BBD209A293DAAD4DC542EE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6A175A8A Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 6A175B66
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 6A175B70
UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 6A175B7D
GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 6A175B98
TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 6A175B9F

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: dfa628f3c7e7d4bf2aad064f1e38cac3c8b16a761a2bfe5bdd28b4975a301c9e
Instruction ID: 1d427a563bc23de03b53018a63a25007cf7e36b49078a32a953fb06b17cb8599
Opcode Fuzzy Hash: dfa628f3c7e7d4bf2aad064f1e38cac3c8b16a761a2bfe5bdd28b4975a301c9e
Instruction Fuzzy Hash: 9C31D1B4D013289BCB60DF64D989788BBB8AF19318F1050EAE50DA7250EB749FC58F08

Uniqueness

Uniqueness Score: -1.00%

Function 6A1751C7 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6A176B91
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6A176BA6
UnhandledExceptionFilter.KERNEL32(6A183328), ref: 6A176BB1
GetCurrentProcess.KERNEL32(C0000409), ref: 6A176BCD
TerminateProcess.KERNEL32(00000000), ref: 6A176BD4

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 2339a3b90d43c255fb4ff1c1d175c38922c55c2c6bf2d4b69e86d7e223559f5b
Instruction ID: 5bee4eab65b7939d1381427a706527be44094c9cc08bc6779c680c879b44439f
Opcode Fuzzy Hash: 2339a3b90d43c255fb4ff1c1d175c38922c55c2c6bf2d4b69e86d7e223559f5b
Instruction Fuzzy Hash: 4721A9B89002049FCB40EF68C588A447BF4FF2B715F61501AE929C6280EBB49D868F05

Uniqueness

Uniqueness Score: -1.00%

Function 6A152AD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 202fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,?,00000002), ref: 6A152BB4
GetLastError.KERNEL32 ref: 6A152BC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 6A152BDF
UnmapViewOfFile.KERNEL32(00000000), ref: 6A152C88
CloseHandle.KERNEL32(?), ref: 6A152C96
OpenEventW.KERNEL32(00000002,00000000,?), ref: 6A152CA8
GetLastError.KERNEL32 ref: 6A152CBD
SetEvent.KERNEL32(00000000), ref: 6A152CC4
GetLastError.KERNEL32 ref: 6A152CCE
CloseHandle.KERNEL32(00000000), ref: 6A152CD5
GetLastError.KERNEL32 ref: 6A152CDF

Strings

Can not open mapping, xrefs: 6A152BCD
Incorrect mapping data, xrefs: 6A152C02
data error, xrefs: 6A152C6A
Incorrect command line, xrefs: 6A152B13, 6A152B63
MapViewOfFile error, xrefs: 6A152BEE

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$File$CloseEventHandleOpenView$MappingUnmap
String ID: Can not open mapping$Incorrect command line$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 1601163770-464465891
Opcode ID: ae80703c7e8258ae3935e86a8717b3f82598cc29608a31bff9d5fc1da76d46ba
Instruction ID: a51c78b26f145af20f3a03da4da401b6897c26dea9f0e7aaac6edea34c71b5d8
Opcode Fuzzy Hash: ae80703c7e8258ae3935e86a8717b3f82598cc29608a31bff9d5fc1da76d46ba
Instruction Fuzzy Hash: B16149F6E002099BDB11DFA8C848B9EB7B4EF06358F154164E925BB241EF70ED11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A177472 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,6A176386,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A17747C
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6A1774A3
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6A1774B0
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6A1774BD
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6A1774CA
TlsAlloc.KERNEL32(?,?,6A176386,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A17751A
TlsSetValue.KERNEL32(00000000,?,?,6A176386,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177535
GetCurrentThreadId.KERNEL32 ref: 6A1775E4

Part of subcall function 6A177790: Sleep.KERNEL32(000003E8,?,?,6A1770BE,KERNEL32.DLL,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?), ref: 6A17779C
Part of subcall function 6A177790: GetModuleHandleW.KERNEL32(6A15FA7E,?,6A1770BE,KERNEL32.DLL,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?,?), ref: 6A1777A5

Part of subcall function 6A17711E: TlsFree.KERNEL32(00000015,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177149
Part of subcall function 6A17711E: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A1780C0
Part of subcall function 6A17711E: DeleteCriticalSection.KERNEL32(00000015,?,?,6A17641B,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A1780EA

Strings

KERNEL32.DLL, xrefs: 6A177476, 6A17747B, 6A177486
FlsAlloc, xrefs: 6A17749D
FlsSetValue, xrefs: 6A1774B2
FlsGetValue, xrefs: 6A1774A5
FlsFree, xrefs: 6A1774BF

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc$CriticalDeleteHandleModuleSection$AllocCurrentFreeSleepThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3695068788-3819984048
Opcode ID: 1cd9d91edb90afccb61b5cd1da44ea7f3aadd8d33f4522a182ff4b31343a13c0
Instruction ID: 092fb0ec608febd9e63f3a10d727e74405afc93c19adebfa7b9b2f31158e1173
Opcode Fuzzy Hash: 1cd9d91edb90afccb61b5cd1da44ea7f3aadd8d33f4522a182ff4b31343a13c0
Instruction Fuzzy Hash: 50317075901311AAFF209F75880CA157BE4EF1B768F25252BE8B2D2291EF36C842CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6A17D750 Relevance: 16.8, APIs: 11, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,6A184BBC,00000001,00000000,00000000,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6A17D782
GetLastError.KERNEL32 ref: 6A17D794
MultiByteToWideChar.KERNEL32(00000100,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6A17D820
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 6A17D88C
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 6A17D8A8
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 6A17D8E2
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 6A17D946
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 6A17D969
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,00000100,?,00000000,?,?,?,?), ref: 6A17D9F9
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000100,?,00000000,?), ref: 6A17DA6B
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,00000100,?,00000000,?,?,?,?,00000001,?,00000000), ref: 6A17DAB8

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 250f23895906b4ae2888cc80b67e36a19e850d53f65bda8abb6322c3eda43c0f
Instruction ID: 277763b31f95370eec2918e371aca623cb3094f6a0269c43965ece1be7442eb0
Opcode Fuzzy Hash: 250f23895906b4ae2888cc80b67e36a19e850d53f65bda8abb6322c3eda43c0f
Instruction Fuzzy Hash: 94B1AC7280411DFFDF218FA4CC8489E7BF6FB59368B166129F914A6150EB31C961DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A17B89E Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 128libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library), ref: 6A17B8C6
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 6A17B8E2

Part of subcall function 6A176FF4: TlsGetValue.KERNEL32(00000000,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A177006
Part of subcall function 6A176FF4: TlsGetValue.KERNEL32(00000005,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A17701D

GetProcAddress.KERNEL32(00000000,00000000), ref: 6A17B8FF

Part of subcall function 6A176FF4: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A177033
Part of subcall function 6A176FF4: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6A17704E

GetProcAddress.KERNEL32(00000000,00000000), ref: 6A17B914
GetProcAddress.KERNEL32(00000000,00000000), ref: 6A17B929
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 6A17B941

Strings

MessageBoxA, xrefs: 6A17B8DC
USER32.DLL, xrefs: 6A17B8C1
GetProcessWindowStation, xrefs: 6A17B93B

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc$Value$HandleLibraryLoadModule
String ID: GetProcessWindowStation$MessageBoxA$USER32.DLL
API String ID: 2739679353-2247880650
Opcode ID: b5d73a80e2564064e0e967ebd02056400e562a4d8b662e7ea426556e16265907
Instruction ID: 96153b8df3a2e0af44a5b24ac5ce688a5cfd23cc013eaecc09d73090693804ad
Opcode Fuzzy Hash: b5d73a80e2564064e0e967ebd02056400e562a4d8b662e7ea426556e16265907
Instruction Fuzzy Hash: C241CBB280430AABDF30ABB48C59B6E3BE99F56764F162429F835D2142EF34D940CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1001D844 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,1001CEDA,?,Microsoft Visual C++ Runtime Library,00012010,?,10021594,?,100215E4,?,?,?,Runtime Error!Program: ), ref: 1001D856
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1001D86E
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 1001D87F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 1001D88C

Strings

GetActiveWindow, xrefs: 1001D879
user32.dll, xrefs: 1001D851
MessageBoxA, xrefs: 1001D868
GetLastActivePopup, xrefs: 1001D881

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction ID: 0f002242f215f962b8815e3b350398d74b100aa23eb915cf8c40db05b23b1dbb
Opcode Fuzzy Hash: fdf4bd263d9911628fa84a0538cd68ee630e044ef978d7ae2b799142876d2cfd
Instruction Fuzzy Hash: A9014431604221AFE750FFF59CC4AAA7BE9EB59194721043BF604C6121DF35C8829B70

Uniqueness

Uniqueness Score: -1.00%

Function 1001DD3D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10021660,00000001,00000000,00000000,75F2E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DD7F
LCMapStringA.KERNEL32(00000000,00000100,1002165C,00000001,00000000,00000000,?,?,1001DA1F,?), ref: 1001DD9B
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,75F2E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DDE4
MultiByteToWideChar.KERNEL32(?,1002CE51,00000000,00000001,00000000,00000000,75F2E860,1002CE50,?,00000003,00000000,00000001,00000000,?,?,1001DA1F), ref: 1001DE1C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1001DE74
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 1001DE8A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 1001DEBD
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 1001DF25

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction ID: 295e34877b95ddc79519c14bcd414cd7068b9c5c0158a783dd3936514e77c558
Opcode Fuzzy Hash: 7282f78b9d4349d0a3e93c4e54105c3ff287b2395515df487960fdaa6e95e452
Instruction Fuzzy Hash: FB517B31400259ABDF22EF94CD85ADE3FF9FB59751F20411AF910A9160C732DDA1EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A17A76A Relevance: 13.6, APIs: 9, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6A17A788
GetLastError.KERNEL32(?,?,?), ref: 6A17A79C
GetEnvironmentStringsW.KERNEL32(?,?,?), ref: 6A17A7C3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?), ref: 6A17A7FD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?), ref: 6A17A820
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?), ref: 6A17A836
GetEnvironmentStrings.KERNEL32(?,?,?), ref: 6A17A849
FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?), ref: 6A17A87B
FreeEnvironmentStringsA.KERNEL32(00000000,?,?,?), ref: 6A17A894

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 4109468225-0
Opcode ID: 925518f2d4d8334a3fe6de5f25c1e086d191574e44afa999859453f7d8018864
Instruction ID: df2ec859095204e72f946297374fef4f3d1babf5ac81cf80f197954e8d137562
Opcode Fuzzy Hash: 925518f2d4d8334a3fe6de5f25c1e086d191574e44afa999859453f7d8018864
Instruction Fuzzy Hash: 523192B2D04125BEDB216FB88C88C1E7BBDEB5B7557262469F652D3100EE31CD8297A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A166530 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 323libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6A166AD8,GetHandlerProperty2), ref: 6A166584
GetProcAddress.KERNEL32(?,GetHandlerProperty), ref: 6A166595
GetProcAddress.KERNEL32(?,GetNumberOfFormats), ref: 6A1665B1

Strings

GetHandlerProperty2, xrefs: 6A166579
GetNumberOfFormats, xrefs: 6A1665AB
GetHandlerProperty, xrefs: 6A16658F

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetNumberOfFormats
API String ID: 190572456-3564775856
Opcode ID: 37f369c1008be7048e4a68f86ff8f062f52e27d2a3e0643386e9c3c352547df3
Instruction ID: 4656566cef702b7e7be3a8b426828f5bb9b459ad2ded2f3f155c7e08f7becce3
Opcode Fuzzy Hash: 37f369c1008be7048e4a68f86ff8f062f52e27d2a3e0643386e9c3c352547df3
Instruction Fuzzy Hash: 3AD16BB1D002189FDB28DFA8CC84B9EBBB9BF58310F1581ADD529E7241DB309A55CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6A176E10 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,6A18F429,00000104,?,6A15FA7E,?), ref: 6A176EB3
GetStdHandle.KERNEL32(000000F4,00000001,?,00000000,00000003,00000003,?,6A176FE7,000000FC,6A178132,6A188028,0000000C,6A1781EF,6A15FA7E,?), ref: 6A176F86
WriteFile.KERNEL32(00000000,00000000,00000000,6A15FA7E,00000000,?,6A176FE7,000000FC,6A178132,6A188028,0000000C,6A1781EF,6A15FA7E,?,?,6A17C6AB), ref: 6A176FB0

Strings

..., xrefs: 6A176F02
Microsoft Visual C++ Runtime Library, xrefs: 6A176F74
Runtime Error!Program: , xrefs: 6A176E75
<program name unknown>, xrefs: 6A176EBD

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 2eb7bb78136330a9e74338c767626940f327f1204b23e16e7def911d4b1adbea
Instruction ID: 8bd1dd633d2a7f391edc07b5ddc21e1c23033216c1f0a4d2d7670cad676fc252
Opcode Fuzzy Hash: 2eb7bb78136330a9e74338c767626940f327f1204b23e16e7def911d4b1adbea
Instruction Fuzzy Hash: 144147F2A042287AE73156748C98F6F769C8F13668F462625FD25E6183EF22CE0145F2

Uniqueness

Uniqueness Score: -1.00%

Function 1001CDB6 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 1001CE23
GetStdHandle.KERNEL32(000000F4,10021594,00000000,?,00000000,?), ref: 1001CEF9
WriteFile.KERNEL32(00000000), ref: 1001CF00

Strings

<program name unknown>, xrefs: 1001CE33
..., xrefs: 1001CE75
Microsoft Visual C++ Runtime Library, xrefs: 1001CECF
Runtime Error!Program: , xrefs: 1001CE89

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction ID: d8c9acc08caec27d87d178c777f48a963db8df66c36a8e0edad6fccd900c7ff8
Opcode Fuzzy Hash: 1d1f0148e6be3939dc2033fdbd363d62c3fffa52be97f4f1b611f55ef9c5ba02
Instruction Fuzzy Hash: 4131C476A0022CAFEB11EAA0CD85FDE77BDFB45344F6001A6F945DA041E770EAC5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 6A17715B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6A187F58,0000000C,6A177296,00000000,00000000,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B), ref: 6A17716D
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6A1771A1
GetProcAddress.KERNEL32(?,DecodePointer), ref: 6A1771B1
InterlockedIncrement.KERNEL32(02C08302), ref: 6A1771E0

Part of subcall function 6A177790: Sleep.KERNEL32(000003E8,?,?,6A1770BE,KERNEL32.DLL,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?), ref: 6A17779C
Part of subcall function 6A177790: GetModuleHandleW.KERNEL32(6A15FA7E,?,6A1770BE,KERNEL32.DLL,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?,?), ref: 6A1777A5

Strings

KERNEL32.DLL, xrefs: 6A177167, 6A17716C, 6A177177
EncodePointer, xrefs: 6A177195
DecodePointer, xrefs: 6A1771A9

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressHandleModuleProc$IncrementInterlockedSleep
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 3998264955-2843748187
Opcode ID: 8319d0bf1cea3e038b2aa3561834e8d15e17fb7e52468d2efcf77e91b08bafd9
Instruction ID: 64411d50d24d911b510a61155e73566df5f248b0ce5b60ad6d3b8613b3f5846f
Opcode Fuzzy Hash: 8319d0bf1cea3e038b2aa3561834e8d15e17fb7e52468d2efcf77e91b08bafd9
Instruction Fuzzy Hash: E9119AB1800701AFE7209F79C808B5AFBF0EF05328F15555AE4A9A6290CF34EA41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 1001CC4B Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CC66
GetEnvironmentStrings.KERNEL32(?,?,?,?,10019F70), ref: 1001CC7A
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CCA6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10019F70), ref: 1001CCDE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10019F70), ref: 1001CD00
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10019F70), ref: 1001CD19
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10019F70), ref: 1001CD2C
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 1001CD6A

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction ID: 10dabb665d0db05ed410ab17b42963db07fe2840a9ab64d8aea903b972c4df90
Opcode Fuzzy Hash: 27e7f926a98a65f15a8b3ff8da03a04564288c716e1c3f2051146ef706dc850c
Instruction Fuzzy Hash: 7331A6B25043AE5FE311EBB8ACC5D2A7ADDEB4A1D4B220639F545CB111EA31DCC187A1

Uniqueness

Uniqueness Score: -1.00%

Function 6A17BD53 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000000), ref: 6A17BD6D
InterlockedDecrement.KERNEL32(?), ref: 6A17BD7A
InterlockedDecrement.KERNEL32(?), ref: 6A17BD87
InterlockedDecrement.KERNEL32(?), ref: 6A17BD94
InterlockedDecrement.KERNEL32(?), ref: 6A17BDA1
InterlockedDecrement.KERNEL32(?), ref: 6A17BDBD
InterlockedDecrement.KERNEL32(?), ref: 6A17BDCD
InterlockedDecrement.KERNEL32(?), ref: 6A17BDE3

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: DecrementInterlocked
String ID:
API String ID: 3448037634-0
Opcode ID: 42ed13d07a29a3345450437b6936554988cf7137e3156da8a3ae3ad254415954
Instruction ID: 868a6508ca7c8d1c57ac186f30c7dc65bbd83aeb6e501062ee645485220c7d8c
Opcode Fuzzy Hash: 42ed13d07a29a3345450437b6936554988cf7137e3156da8a3ae3ad254415954
Instruction Fuzzy Hash: AE116D71B04715ABEB10DF79CC84B9ABBEDAF54658F055416A829DB202CF34E900CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6A17BCC4 Relevance: 12.1, APIs: 8, Instructions: 58COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(6A15FA7E), ref: 6A17BCD6
InterlockedIncrement.KERNEL32(00000D89), ref: 6A17BCE3
InterlockedIncrement.KERNEL32(E58B5B5E), ref: 6A17BCF0
InterlockedIncrement.KERNEL32(5F590000), ref: 6A17BCFD
InterlockedIncrement.KERNEL32(8B55CCCC), ref: 6A17BD0A
InterlockedIncrement.KERNEL32(8B55CCCC), ref: 6A17BD26
InterlockedIncrement.KERNEL32(F07589E0), ref: 6A17BD36
InterlockedIncrement.KERNEL32(A157559F), ref: 6A17BD4C

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: IncrementInterlocked
String ID:
API String ID: 3508698243-0
Opcode ID: 7640cfafed4d79f3a2b9013d8184d1a064b628517bc2faea91cd370a4bda984b
Instruction ID: 70cafb1698680ab108c43bbcb5d006c8e0799cc50a2199e9543223e7989672e5
Opcode Fuzzy Hash: 7640cfafed4d79f3a2b9013d8184d1a064b628517bc2faea91cd370a4bda984b
Instruction Fuzzy Hash: F8112D71B04319ABEB10DF79CC88B9ABBECEF55694F059416A919DB142DF34E800CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6A17DF24 Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000001,?,00000000,00000000,?,?,?,?,6A17D6F0,00000000,?,00000001,?,?,?), ref: 6A17DF6F
GetCPInfo.KERNEL32(?,00000001,?,6A17D6F0,00000000,?), ref: 6A17DF88
MultiByteToWideChar.KERNEL32(?,00000001,?,6A17D6F0,00000000,00000000,?,6A17D6F0,00000000,?,00000001,?,?,?,?,00000001), ref: 6A17DFE6
MultiByteToWideChar.KERNEL32(?,00000001,?,6A17D6F0,?,00000000,?,?,?,?,?,?,?,6A17D6F0,00000000,?), ref: 6A17E035
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6A17D6F0), ref: 6A17E050
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6A17D6F0), ref: 6A17E076
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6A17D6F0), ref: 6A17E09B

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: d397277ef69f5008e609e4d14a28d5eb4f3bcc6e7a0f278739ba2ae88f409775
Instruction ID: c49ee59752adf4f98816bbffcd94cd3b941c806b490303925b6db50a2de6e738
Opcode Fuzzy Hash: d397277ef69f5008e609e4d14a28d5eb4f3bcc6e7a0f278739ba2ae88f409775
Instruction Fuzzy Hash: E0514D31E00219AFCF218F95DC44DEEBBF9FB8A760F215119E524A6190DB31D951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A172980 Relevance: 10.6, APIs: 7, Instructions: 74fileCOMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(6A150000,00000000,6A150000,?,?,6A172B94,?), ref: 6A172993
SizeofResource.KERNEL32(6A150000,00000000), ref: 6A1729A1
LockResource.KERNEL32(00000000), ref: 6A1729AE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 6A1729CF
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 6A1729E5
CloseHandle.KERNEL32(00000000), ref: 6A1729FA
DeleteFileW.KERNEL32(00000000), ref: 6A172A0A

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileResource$CloseCreateDeleteHandleLoadLockSizeofWrite
String ID:
API String ID: 406028064-0
Opcode ID: e2086bce009cc1900930d69634a1a7ca7463ab30542403d3b758572a65e1e8fc
Instruction ID: 48b0e398bf2d470d41cd44979e0ff2094a15f527a9641737bcc4c278d3982e5e
Opcode Fuzzy Hash: e2086bce009cc1900930d69634a1a7ca7463ab30542403d3b758572a65e1e8fc
Instruction Fuzzy Hash: 4211E9357403146BD7209B698C48F9BFBBCDB97661F1841A5FE51E7280DA71DC0786B0

Uniqueness

Uniqueness Score: -1.00%

Function 6A176FF4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A177006
TlsGetValue.KERNEL32(00000005,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A17701D
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6A17706D,00000000,6A17B8AE,6A18F410,00000000,00000314,?,6A176F7F,6A18F410,Microsoft Visual C++ Runtime Library,00012010), ref: 6A177033
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6A17704E

Strings

KERNEL32.DLL, xrefs: 6A17702D, 6A177032, 6A17703D
EncodePointer, xrefs: 6A177048

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: c316dd216c5d28035ab43e420ad9ea4dddc359ab316b3fba7838feda2cce148b
Instruction ID: 5008e637aa7a69b03a503b1b1b1d8b6ffe22268b3adeb6b5aee5338115a66447
Opcode Fuzzy Hash: c316dd216c5d28035ab43e420ad9ea4dddc359ab316b3fba7838feda2cce148b
Instruction Fuzzy Hash: 4DF0187960061AABDF219F25CC44E697BE8EF13364B151062FD28D7150DF31DD528A94

Uniqueness

Uniqueness Score: -1.00%

Function 6A17706F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6A15FA7E,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?), ref: 6A177081
TlsGetValue.KERNEL32(00000005,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?), ref: 6A177098
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6A1794A4,?,6A175FE3,6A15FA7E,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?), ref: 6A1770AE
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6A1770C9

Strings

KERNEL32.DLL, xrefs: 6A1770A8, 6A1770AD, 6A1770B8
DecodePointer, xrefs: 6A1770C3

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 657d3cb334c4d1550b63db78ae95425d3c09748ac12db05b9e10c427e47c7e33
Instruction ID: 9b7936d23aedb820ca375345062ddd58a30d98a166eed2ec04a7c92107d32eb8
Opcode Fuzzy Hash: 657d3cb334c4d1550b63db78ae95425d3c09748ac12db05b9e10c427e47c7e33
Instruction Fuzzy Hash: 8EF0627550061AABDF21AF25CC08EAE7BE9DF43260B061166FC28E7190DF21DD528B94

Uniqueness

Uniqueness Score: -1.00%

Function 6A160450 Relevance: 9.2, APIs: 6, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6A162A70: CloseHandle.KERNEL32(?,ED279CBA,?,00000000,?,?,00000000,?,?,?,00000000,6A180C38,000000FF), ref: 6A162A9F
Part of subcall function 6A162A70: CreateFileW.KERNEL32(?,?,00000000,00000000,?,00000080,00000000,ED279CBA,?,00000000,?,?,00000000), ref: 6A162ACC
Part of subcall function 6A162A70: CreateFileW.KERNEL32(?,?,?,00000000,00000000,00000080,00000000), ref: 6A162B2B

GetFileSize.KERNEL32(FFFFFFFF,?,00000004,80000000,00000001,00000003,ED279CBA,?,?,00000000,?,?,?,00000000,6A180C38,000000FF), ref: 6A1604A7
GetLastError.KERNEL32(?,?,?,00000000,6A180C38,000000FF), ref: 6A1604B4
CloseHandle.KERNEL32(FFFFFFFF,00000004,80000000,00000001,00000003,ED279CBA,?,?,00000000,?,?,?,00000000,6A180C38,000000FF), ref: 6A16051D
CloseHandle.KERNEL32(FFFFFFFF,?,00000000,00000000,00000001,?,?,?,00000000,6A180C38,000000FF), ref: 6A16053D
CloseHandle.KERNEL32(FFFFFFFF,FFFFFFFF,00000000,?,00000000,00000000,00000001,?,?,?,00000000,6A180C38,000000FF), ref: 6A16056C

Part of subcall function 6A160A20: MultiByteToWideChar.KERNEL32(00000002,00000000,?,?,?,?,ED279CBA,00000000), ref: 6A160AA7

CloseHandle.KERNEL32(FFFFFFFF,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 6A1606D8

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseHandle$File$Create$ByteCharErrorLastMultiSizeWide
String ID:
API String ID: 2846089904-0
Opcode ID: e659e58c23f3d170fe4b9139a83b93766875b7271925f9cab51e19d11f635c58
Instruction ID: f4daa20b8ca2c931479606b9e9296f8ea19fa7ad80f655f948fccdf473401713
Opcode Fuzzy Hash: e659e58c23f3d170fe4b9139a83b93766875b7271925f9cab51e19d11f635c58
Instruction Fuzzy Hash: 9281A172E002089BCF10DFA4D844BEEB7B5EF55324F129629E825F7281EF35A915CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6A17D506 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,6A184BBC,00000001,?,00000100,?,?,?,?,?,6A17D6F0,00000000,?,00000001,?,?), ref: 6A17D535
GetLastError.KERNEL32(?,6A17D6F0,00000000,?,00000001,?,?,?,?,00000001,?,00000000,00000001,00000000), ref: 6A17D547
MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,00000100,?,?,?,?,?,6A17D6F0,00000000,?,00000001), ref: 6A17D5AC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 6A17D616
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6A17D624
GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,?,?,?,?,?,6A17D6F0,00000000,?,00000001,?), ref: 6A17D699

Part of subcall function 6A17DF24: GetCPInfo.KERNEL32(?,00000001,?,00000000,00000000,?,?,?,?,6A17D6F0,00000000,?,00000001,?,?,?), ref: 6A17DF6F
Part of subcall function 6A17DF24: GetCPInfo.KERNEL32(?,00000001,?,6A17D6F0,00000000,?), ref: 6A17DF88
Part of subcall function 6A17DF24: MultiByteToWideChar.KERNEL32(?,00000001,?,6A17D6F0,?,00000000,?,?,?,?,?,?,?,6A17D6F0,00000000,?), ref: 6A17E035
Part of subcall function 6A17DF24: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6A17D6F0), ref: 6A17E050

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Info$ErrorLast
String ID:
API String ID: 2250435928-0
Opcode ID: fcf33fa3a4560406c489e8193653c41f509f45a9bda8098d09c3a2db1f4ab660
Instruction ID: fa4b25a86c59bc77537eff3fa3d87d09bb245db48f30c83e204761b513156bfb
Opcode Fuzzy Hash: fcf33fa3a4560406c489e8193653c41f509f45a9bda8098d09c3a2db1f4ab660
Instruction Fuzzy Hash: A45147B150010EAFDF209F68CC85DAE7BF9EB19368B225529F914DB150DB30D9A18FA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001DF8C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10021660,00000001,?,75F2E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001DFCB
GetStringTypeA.KERNEL32(00000000,00000001,1002165C,00000001,?,?,?,1001DA1F,?), ref: 1001DFE5
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,75F2E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E019
MultiByteToWideChar.KERNEL32(?,1002CE51,?,00000000,00000000,00000000,75F2E860,1002CE50,?,?,00000002,00000000,?,?,1001DA1F,?), ref: 1001E051
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1001E0A7
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1001E0B9

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction ID: 73f36e6d74bf66f6ce57e3c8a420cabe8a1af6d8c6052cc8844ff2d98f481940
Opcode Fuzzy Hash: 9cb96698784a2f131f153e3bcad8cc4bc2e41755872ea77c6cd091048275da51
Instruction Fuzzy Hash: 0041577250029AAFDB21DF94CC85EDE7BBAEB09790F20052AFA119A150C735DDD1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001A27C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 1001A29B
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 1001A2D0
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001A330

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 1001A30A
__MSVCRT_HEAP_SELECT, xrefs: 1001A2CB

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction ID: ff41b7170f7c9f9639ed0085cf635e38180a7bd29c628196ad01e98acd5c5e28
Opcode Fuzzy Hash: 8d68a081adb5fb00688b35fa97c12b05e84aee0a2816abf6642aa1a3e48e784b
Instruction Fuzzy Hash: DB310575C412986EEB61D6745C81BDD37E9DB17344F2400EAF195DE042E631DFC99B20

Uniqueness

Uniqueness Score: -1.00%

Function 6A1669E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,ED279CBA,6A18FCC8,00000000), ref: 6A166A18
FreeLibrary.KERNEL32(00000000), ref: 6A166A38
FreeLibrary.KERNEL32(00000000,ED279CBA,6A18FCC8,00000000), ref: 6A166A84
GetProcAddress.KERNEL32(?,CreateObject), ref: 6A166AA5

Strings

CreateObject, xrefs: 6A166A9D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: CreateObject
API String ID: 1386263645-166191583
Opcode ID: d1a4945cf5d61681f53205bf68833e895b4ec3526e73a52cb7f70d9a9e3c1373
Instruction ID: 13d44148e7aa0f3a453385be3c57eb92b92762e271cbe41517a10fd26b012e9e
Opcode Fuzzy Hash: d1a4945cf5d61681f53205bf68833e895b4ec3526e73a52cb7f70d9a9e3c1373
Instruction Fuzzy Hash: 6C416A75A00209EFDB04CF69C984B9ABBF5FF49310F14851AE829DB380DB34E950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A177C8C Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 6A177CA1

Part of subcall function 6A177653: Sleep.KERNEL32(00000000,?,6A15FA7E,?), ref: 6A17767B

GetFileType.KERNEL32(00000040,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177DCB
GetStdHandle.KERNEL32(-000000F6,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177E55
GetFileType.KERNEL32(00000000,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A177E67
SetHandleCount.KERNEL32 ref: 6A177EBF

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileHandleType$CountInfoSleepStartup
String ID:
API String ID: 1302456922-0
Opcode ID: 82bec9ffe326026b725861608d3b28dfa49e47a9872dc5895ecf0577db30f8e2
Instruction ID: a56dc2959ed0d6d9e6028c623023cc66e1257cab3bae0004f63e5831b2f22e6d
Opcode Fuzzy Hash: 82bec9ffe326026b725861608d3b28dfa49e47a9872dc5895ecf0577db30f8e2
Instruction Fuzzy Hash: 75710E715047418EEB208B28C888B697BE0EF27334F2A965AD1759B2E2DF34D845CB11

Uniqueness

Uniqueness Score: -1.00%

Function 1001C735 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 1001C793
GetFileType.KERNEL32(00000480), ref: 1001C83E
GetStdHandle.KERNEL32(-000000F6), ref: 1001C8A1
GetFileType.KERNEL32(00000000), ref: 1001C8AF
SetHandleCount.KERNEL32 ref: 1001C8E6

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction ID: 9e0b50c6418c78b4ce1b27a1f486aee3850f1a3a2b75f6582e04b96d90fbb996
Opcode Fuzzy Hash: 96bd8d765951caf66320892a5d82298be417aadad03bc705412f471f5a66fdb5
Instruction Fuzzy Hash: 0C51243190436A8FE710DB68C8C4F697BE0EB05768F354669D5A29F2E2DB30DC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6A17CDE3 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(FFFFFFFE,?,00000001,?,00000000,00000000), ref: 6A17CE2B
GetLastError.KERNEL32 ref: 6A17CE3E
GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000083,00000005,00000000,00000000,00000000), ref: 6A17CE5E
WideCharToMultiByte.KERNEL32(00000000), ref: 6A17CE65
WriteConsoleA.KERNEL32(FFFFFFFE,00000083,00000000,?,00000000), ref: 6A17CE81

Part of subcall function 6A17DC35: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6A17CE0E,00000000), ref: 6A17DC48

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: 135dbbc5a40b927e0aadb9adf43a41ebdf5d4419800d689cd519ddb30597e270
Instruction ID: a63f3ce5998e9bf5f22aab0aaac1b0ab7bd368e6e66b7b91f1a64f12b6e28538
Opcode Fuzzy Hash: 135dbbc5a40b927e0aadb9adf43a41ebdf5d4419800d689cd519ddb30597e270
Instruction Fuzzy Hash: 22216D71501218ABDB20DB64CC48EEF7BF9EB57760B81121AF511C7180DF70EA45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A17A8ED Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6A17A924
GetCurrentProcessId.KERNEL32 ref: 6A17A930
GetCurrentThreadId.KERNEL32 ref: 6A17A938
GetTickCount.KERNEL32 ref: 6A17A940
QueryPerformanceCounter.KERNEL32(?), ref: 6A17A94C

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 7618429e382567cdebf76b7d25983f17b3fe28ab7a9cff46e2d87e7718dee73e
Instruction ID: 831f70884812aca271834ba207524064e60ba30e74d67db17ceff50d196f9cb4
Opcode Fuzzy Hash: 7618429e382567cdebf76b7d25983f17b3fe28ab7a9cff46e2d87e7718dee73e
Instruction Fuzzy Hash: AA115E72D00224ABDF209BB8C94869EFBF8EB5E751F971516E901E7200EE30DD158798

Uniqueness

Uniqueness Score: -1.00%

Function 1001C031 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,1001C473,1001D0D7,00000000,?,?,00000000,00000001), ref: 1001C033
TlsGetValue.KERNEL32 ref: 1001C041
SetLastError.KERNEL32(00000000), ref: 1001C08D

Part of subcall function 1001C480: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10019E24,10021318,000000FF,?,1001C056,00000001,00000074), ref: 1001C576

TlsSetValue.KERNEL32(00000000), ref: 1001C065
GetCurrentThreadId.KERNEL32 ref: 1001C076

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction ID: c7b26c2ea065f329baa6dbda2ade13875997561f4633f5fb0c8b07fada39eb07
Opcode Fuzzy Hash: 2a7b4345b55e60806f6563897d190d9d6c15b8e2791512da656746999b9ff8e8
Instruction Fuzzy Hash: 0DF0BB35901331DBF2329B749C89F1A3AA6EF097B1F214318F6559E1A1CB30D8C29690

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0CE Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A102

Part of subcall function 100189EE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 10018AC2

DeleteCriticalSection.KERNEL32(?,?,1001C005,10019FBC,1001A015,?,?,?), ref: 1001A11D
DeleteCriticalSection.KERNEL32 ref: 1001A125
DeleteCriticalSection.KERNEL32 ref: 1001A12D
DeleteCriticalSection.KERNEL32 ref: 1001A135

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction ID: 436f94670acdd869086ea8be0b95e1bb75b4415bd69928cd2107d9a27a45b4f1
Opcode Fuzzy Hash: 31fd23f1ab8c03e9a7f37bef3c6a7256c8a93bd33ca8f004c8e74067c6c1dcf0
Instruction Fuzzy Hash: 1AF0F4268002647AEA65F719AD8C8A97BD5DB822B27920476EC53B7030CD778CC29DA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A165F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetMethodProperty), ref: 6A165F83
GetProcAddress.KERNEL32(00000000,GetNumberOfMethods), ref: 6A165F9F

Strings

GetNumberOfMethods, xrefs: 6A165F99
GetMethodProperty, xrefs: 6A165F77

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressProc
String ID: GetMethodProperty$GetNumberOfMethods
API String ID: 190572456-2134343882
Opcode ID: 06fe88c58fa660d7be3086bcdf4628abaef97eea969aeb035e61cf0f5007d4de
Instruction ID: 3025e58598038de154e841c6bf83d4e1006aed074838435cd1bc0a4a53ab0805
Opcode Fuzzy Hash: 06fe88c58fa660d7be3086bcdf4628abaef97eea969aeb035e61cf0f5007d4de
Instruction Fuzzy Hash: C8216B75E01319EBCB04CFA4D98499EF7B9FF48318B11406AED14E7202EB31E916CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A165BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\7-zip,00000000,00020019,6A17FD48,ED279CBA,00000000,?,80000001,00000000,6A17FD48,000000FF,?,6A165DBD,?,6A18FCC8), ref: 6A165C1D

Part of subcall function 6A162FE0: RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6A165DBD,?,?,6A165C37,?,6A165DBD,?,6A18FCC8,00000000,00000000), ref: 6A16300E
Part of subcall function 6A162FE0: RegQueryValueExW.ADVAPI32(6A165DBD,Path,00000000,6A165DBD,?,6A165DBD,?,6A165DBD,?,6A18FCC8,00000000,00000000), ref: 6A16304E

RegCloseKey.ADVAPI32(?,?,6A165DBD,?,6A18FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6A165C47
RegCloseKey.ADVAPI32(?,?,6A165DBD,?,6A18FCC8,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6A165C65

Strings

Software\7-zip, xrefs: 6A165C11

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CloseQueryValue$Open
String ID: Software\7-zip
API String ID: 4082589901-3321436535
Opcode ID: 59e4bedc1c1ab97f5c3c80286e55bf0e25b2d8b6f265ae9ed175387274cb9cfd
Instruction ID: af3713335592d12ffc27610245e289ae56c0cb68b88d8866e222808178dd6f60
Opcode Fuzzy Hash: 59e4bedc1c1ab97f5c3c80286e55bf0e25b2d8b6f265ae9ed175387274cb9cfd
Instruction Fuzzy Hash: 74118276D05A28ABCB118F44DC44AAFFBBCFB06B60F01066AFC15E7340DB3469158AE4

Uniqueness

Uniqueness Score: -1.00%

Function 6A1777E9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,?,6A177821,6A15FA7E,?,6A178143,000000FF,0000001E,6A188028,0000000C,6A1781EF,6A15FA7E,?,?,6A17C6AB,00000004), ref: 6A1777F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6A177803

Strings

mscoree.dll, xrefs: 6A1777EE
CorExitProcess, xrefs: 6A1777FD

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 40697952105db7a6984714f28315e7a807bb17ff8d05fd09dfb2563e559e8bbe
Instruction ID: 9e5ac56c44d4efee06e6021e0abbd53a56c8283b1d9a957d45105ba56c41201a
Opcode Fuzzy Hash: 40697952105db7a6984714f28315e7a807bb17ff8d05fd09dfb2563e559e8bbe
Instruction Fuzzy Hash: 6AD01270700205B7EF102AB2DD0CA16BEEDDA82B507898425BA1CD1081DF21CC12DD60

Uniqueness

Uniqueness Score: -1.00%

Function 100197CF Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction ID: c5e9eab5286596022c0fc86455b854ac72cbfdbbf2fd81343e62aa3bf37372db
Opcode Fuzzy Hash: fd9724b1c61d381fd748c7ffe039d77dfbf158c8da40872393acd8e509287be1
Instruction Fuzzy Hash: 7791C371D01664AADB11EB68CC81ADE7AF9EF497A0F600226F854BE191D731DDC0CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A17C748 Relevance: 6.4, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 6A175F2A: RtlAllocateHeap.NTDLL(00000000,6A15FA6F,?,00000000,?,?,6A154D3F,0000000C,ED279CBA,?,?,00000000,?,?,6A17EF9B,000000FF), ref: 6A175FA1

GetLastError.KERNEL32(?,6A1752D8,00000000,00000010,?,?,?,6A175364,?,6A187E10,0000000C,6A175390,?,?,6A1778CA,6A17A8C7), ref: 6A17C8C3
GetLastError.KERNEL32(?,6A1752D8,00000000,00000010,?,?,?,6A175364,?,6A187E10,0000000C,6A175390,?,?,6A1778CA,6A17A8C7), ref: 6A17C950

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$AllocateHeap
String ID:
API String ID: 4219743298-0
Opcode ID: dc5b8da90e17ba81d4566b056ffb010e729b8bcfbda22845752342a2ecfb0bf1
Instruction ID: b2dd07fee2f8318a3a99cbc55e5176accfc407543da9a1125c9cf982e1a5d2c9
Opcode Fuzzy Hash: dc5b8da90e17ba81d4566b056ffb010e729b8bcfbda22845752342a2ecfb0bf1
Instruction Fuzzy Hash: AF51E571C04625ABCFB16B788C4C64E77B5EF56364F262516E864EB281EF34D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001B010 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,10025958,10025958,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B031
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B055
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?), ref: 1001B06F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?), ref: 1001B130
HeapFree.KERNEL32(00000000,00000000,?,?,1001B4DC,?,00000010,?,00000009,00000009,?,10018964,00000010,?,?,?), ref: 1001B147

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction ID: 9791cdc1e8676e8be9240cb2db72b85fdf48b460ca22e9baef45e6ba91bfb517
Opcode Fuzzy Hash: 08a6be7fdf41f6db4eaa31ea6addab7da968f7782194b53cc123b6d70fe20246
Instruction Fuzzy Hash: F4312670500B56EBE332CF24CCC5B2677E0EB447A5FA14529F5669B290E771E8C5CB48

Uniqueness

Uniqueness Score: -1.00%

Function 6A17C452 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6A17C1F1: GetOEMCP.KERNEL32(00000000,?,6A17A6C9,?,?,?), ref: 6A17C21A

Part of subcall function 6A17760E: Sleep.KERNEL32(00000000,00000001,6A15FA7E,?,6A17815E,00000018,6A188028,0000000C,6A1781EF,6A15FA7E,?,?,6A17C6AB,00000004,6A1882E8,0000000C), ref: 6A17762F

InterlockedDecrement.KERNEL32(C03314C4), ref: 6A17C4C8
InterlockedIncrement.KERNEL32(00000000), ref: 6A17C4ED
InterlockedDecrement.KERNEL32 ref: 6A17C57F
InterlockedIncrement.KERNEL32(00000000), ref: 6A17C5A3

Part of subcall function 6A175FF4: HeapFree.KERNEL32(00000000,6A15FA7E,6A187EB0,0000000C,6A1781B5,00000000,6A188028,0000000C,6A1781EF,6A15FA7E,?,?,6A17C6AB,00000004,6A1882E8,0000000C), ref: 6A17605C
Part of subcall function 6A175FF4: GetLastError.KERNEL32(?,6A17C6AB,00000004,6A1882E8,0000000C,6A177669,6A15FA7E,?,00000000,00000000,00000000,?,6A17726D,00000001,00000214), ref: 6A17606D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$ErrorFreeHeapLastSleep
String ID:
API String ID: 1703371082-0
Opcode ID: 5159e9afa72178108108d58ef5d6554f10c5c1141570a0ce43a4d434f6bd82b3
Instruction ID: b04a943f9de0b7f8a90a69ce40caedadf21c18e9f25510f7608ac82281d4f6d2
Opcode Fuzzy Hash: 5159e9afa72178108108d58ef5d6554f10c5c1141570a0ce43a4d434f6bd82b3
Instruction Fuzzy Hash: 24419F71A043049BDB209F78C8887997BF0EF0A725F16556AD851DB692CF35E981CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A160F70 Relevance: 6.1, APIs: 4, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,ED279CBA,00000000,?,?,00000000,00000000,00000000), ref: 6A160FAE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 6A16100C
SetFileTime.KERNEL32(00000000,?,?,?,?,?,?), ref: 6A161033
CloseHandle.KERNEL32(00000000,?,?,?), ref: 6A16103F

Part of subcall function 6A1628A0: GetCurrentDirectoryW.KERNEL32(00000105,?,ED279CBA,FFFFFFFF,?,00000004), ref: 6A162994

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: File$Create$CloseCurrentDirectoryHandleTime
String ID:
API String ID: 2622452211-0
Opcode ID: 3675cbaf6edd0359fb4198b50d086a7ddbd84020cff65c28f4c00305245d949c
Instruction ID: 4a4c65594c601199651b2ca8a7ad162c35cfbad8b3e6e27f0ff25263d755be5f
Opcode Fuzzy Hash: 3675cbaf6edd0359fb4198b50d086a7ddbd84020cff65c28f4c00305245d949c
Instruction Fuzzy Hash: 0D21D3B5A40204BBEB109F54CC85FAFB7B8EB46768F114229FA10E72C0CB746E0586A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A16D4C0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6A18FC98,ED279CBA,?,?,?,6A17FB68,000000FF), ref: 6A16D4F2
LeaveCriticalSection.KERNEL32(6A18FC98,?,?,?,6A17FB68,000000FF), ref: 6A16D50A
LeaveCriticalSection.KERNEL32(6A18FC98,?,?,?,?,6A17FB68,000000FF), ref: 6A16D547

Strings

[Content], xrefs: 6A16D52D

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: [Content]
API String ID: 2978645861-3799411330
Opcode ID: 8724d8bf70ea354cc3eb2e4a71a17d14556ade4322b2d2f2f2b4046af4dddce4
Instruction ID: 14bcc0614a1d720cc8c1076d94376ddd16888d61bc4b3d7d02c5bc0e5c719eb0
Opcode Fuzzy Hash: 8724d8bf70ea354cc3eb2e4a71a17d14556ade4322b2d2f2f2b4046af4dddce4
Instruction Fuzzy Hash: 9E0184B2904608AFD711DF59C809F9DB7F8FB0A620F51465AE811E7680DF756D04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A151A30 Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00100000,?,00000000), ref: 6A151A4E
ReadFile.KERNEL32(00000000), ref: 6A151A55
GetLastError.KERNEL32 ref: 6A151A72
GetLastError.KERNEL32 ref: 6A151A80

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 8635c93c03f7be62c67a01fb6177d5256dc7f75bed02919a157e170bd213afca
Instruction ID: 57b71992850682d357a8f8f2657c2ae7db42f7bf9c8f3d00089c02d10b451b7c
Opcode Fuzzy Hash: 8635c93c03f7be62c67a01fb6177d5256dc7f75bed02919a157e170bd213afca
Instruction Fuzzy Hash: 7201F9B634024A5BDB02EE949C00BB773ACDB55360F144536FD26C6180DB30DC2187B0

Uniqueness

Uniqueness Score: -1.00%

Function 100010CC Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 100010CD
WideCharToMultiByte.KERNEL32(?,?,?,00000001,?,00000004), ref: 100010E8
CharUpperA.USER32(?,?,?,?,00000001,?,00000004), ref: 10001101
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,?,?,00000001,?,00000004), ref: 10001114

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Char$ByteMultiWide$ErrorLastUpper
String ID:
API String ID: 1367601523-0
Opcode ID: 72820ca4cf70397f8d93897b94b6977d73b437a33a5f1a0a67e4fe9fcbc230e4
Instruction ID: 8a9f6ad633896971aa68c1c487645b7fc150f811c31040e311e3666a4a254741
Opcode Fuzzy Hash: 72820ca4cf70397f8d93897b94b6977d73b437a33a5f1a0a67e4fe9fcbc230e4
Instruction Fuzzy Hash: F7F01DBA800269BAFB15DB909CC9EDFBBADEB08294F100561FB42E2141D2749E858760

Uniqueness

Uniqueness Score: -1.00%

Function 6A179411 Relevance: 6.0, APIs: 4, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,?,6A176420,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C), ref: 6A179440
HeapFree.KERNEL32(00000000,-00000010,?,00000000,?,6A176420,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9), ref: 6A179450
HeapFree.KERNEL32(00000000,00000000,?,6A176420,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A17946D
HeapDestroy.KERNEL32(6A176420,?,?,?,6A1764EE,?,?,?,6A187F18,0000000C,6A1765A9,?), ref: 6A179477

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: FreeHeap$DestroyVirtual
String ID:
API String ID: 765507482-0
Opcode ID: 67043fe2e331259237cbb6bbdb1a6319f23788aa03f68d81df98c5583e3e486e
Instruction ID: 8ad7c943e3f58584236120a2e4c81fd87fcd4110bdf1d1ff7be5c21f6aab07b4
Opcode Fuzzy Hash: 67043fe2e331259237cbb6bbdb1a6319f23788aa03f68d81df98c5583e3e486e
Instruction Fuzzy Hash: 51F0443A100220AFDF21AB14CD95B05BBE1FF83755F228125E221E60A5C7722C25CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 1001D6B7

Strings

, xrefs: 1001D700
, xrefs: 1001D6DC

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction ID: 27a1dab1f5f815cb8d427bf576b62c8b4ec6ff9cec70f847aa7466e11b016868
Opcode Fuzzy Hash: 14eba8f351f7a606bf476568831cf335b29103052037c0e04881c2f51051340a
Instruction Fuzzy Hash: 2B41483140436C1AEB11FA64CD85FEA7F9ADB01744F1006F7D585CF092D271C989DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A162FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,Path,00000000,?,00000000,6A165DBD,?,?,6A165C37,?,6A165DBD,?,6A18FCC8,00000000,00000000), ref: 6A16300E
RegQueryValueExW.ADVAPI32(6A165DBD,Path,00000000,6A165DBD,?,6A165DBD,?,6A165DBD,?,6A18FCC8,00000000,00000000), ref: 6A16304E

Strings

Path, xrefs: 6A163002, 6A163045

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: QueryValue
String ID: Path
API String ID: 3660427363-2875597873
Opcode ID: 5966ca8d4deb975840512aef692bdfbbf30d937b145d2c7bb3d16800d207e719
Instruction ID: c8e211bd8c3c776bb4c8007e32caecd825ad516181a99411e3caa55ec9e71547
Opcode Fuzzy Hash: 5966ca8d4deb975840512aef692bdfbbf30d937b145d2c7bb3d16800d207e719
Instruction Fuzzy Hash: 32114FB5A04204AFEB14DFA8C8D08AEF7F9FF59700B21946EE546D3241EB709D558B60

Uniqueness

Uniqueness Score: -1.00%

Function 6A178C63 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,-00000010,00000000,00000000,6A1791C3,00000000,?,00000000,6A17EF9B,000000FF,?,6A15FA7E,?), ref: 6A178C8A
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,6A1791C3,00000000,?,00000000,6A17EF9B,000000FF,?,6A15FA7E,?), ref: 6A178CC0
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,6A15FA7E,?), ref: 6A178CDA
HeapFree.KERNEL32(00000000,?,?,6A15FA7E,?), ref: 6A178CF1

Memory Dump Source

Source File: 0000000D.00000002.168275885990.000000006A151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A150000, based on PE: true

Associated: 0000000D.00000002.168275819717.000000006A150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276081808.000000006A183000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276167603.000000006A18D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.168276251655.000000006A1B8000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6a150000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 49beebf6679276f2ced041496e9c6a4988b808ab041c6703fb99118a5ea4a83a
Instruction ID: f60bd6584f41d82ccd5881b94dbb03c220dcde13a84d0bc3db10868aeed41071
Opcode Fuzzy Hash: 49beebf6679276f2ced041496e9c6a4988b808ab041c6703fb99118a5ea4a83a
Instruction Fuzzy Hash: D7118872600710AFDB219F28CC05945BBF1FFD77A0B258A19F6A2E7194D7309C82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1001AB6E Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001AB96
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001A936,?,?,?,10018906,?,?,?,?,?,?), ref: 1001ABCA
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001ABE4
HeapFree.KERNEL32(00000000,?), ref: 1001ABFB

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction ID: 484c1ce75c38baac158856a15f7ab205fd40ab6127819ea80900b3ceb95b3c03
Opcode Fuzzy Hash: 6f699eca9e893f575dde21e6c4b4ec1254527531fada708ecaea67c30c461b13
Instruction Fuzzy Hash: E8112570240321AFE721EF19CCC6A167BF6FB86764B61491AF552C69B1D3729CA2CF40

Uniqueness

Uniqueness Score: -1.00%

Function 1001A0A5 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,1001BFB2,?,10019F53), ref: 1001A0B2
InitializeCriticalSection.KERNEL32 ref: 1001A0BA
InitializeCriticalSection.KERNEL32 ref: 1001A0C2
InitializeCriticalSection.KERNEL32 ref: 1001A0CA

Memory Dump Source

Source File: 0000000D.00000002.168275395272.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000D.00000002.168275332831.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275529893.0000000010020000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275603687.0000000010025000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275668326.0000000010027000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.168275744390.000000001002F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10000000_TechkonDriver64Bit.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction ID: bb73eb11f573fb0f18e311b5dd9e76b2e5dde51fe535fe889abf8312516ef5db
Opcode Fuzzy Hash: 9eddfc3165ec3fc15766a975bd316014652016b7c432d0d5cadee5ee0f614abc
Instruction Fuzzy Hash: BEC00231801138AFFA556B55DC848493FA6EB042723210063E10561030CEB31C93DFE8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: x64DPInst.exePID: 4736, Parent PID: 5720COMMON

Non-executed Functions

Function 00007FF6669CD440 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6669CD477
GetCurrentProcessId.KERNEL32 ref: 00007FF6669CD482
GetCurrentThreadId.KERNEL32 ref: 00007FF6669CD48E
GetTickCount.KERNEL32 ref: 00007FF6669CD49A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6669CD4AB

Memory Dump Source

Source File: 00000013.00000002.167797030807.00007FF666971000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF666970000, based on PE: true

Associated: 00000013.00000002.167796997987.00007FF666970000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000013.00000002.167797156824.00007FF6669F1000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000013.00000002.167797195281.00007FF6669F3000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000013.00000002.167797195281.00007FF666A08000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff666970000_x64DPInst.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction ID: 193ff66b5462934c5023217f32974299c26f01df60566f780df646e514a299ff
Opcode Fuzzy Hash: 404986f5cc30a85b1b110af08f269cf27d5de7fe2ab396615c35e90afeb4e3b4
Instruction Fuzzy Hash: 8F013021758A02C2E7508F22F4501657370FB46F90F452730EE5E8F795CE3EE9858B00

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8ue90oYkrv.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

161fe34.rbf (copy)

C:\Config.Msi\161fe33.rbs

C:\Config.Msi\161fe38.rbs

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver32Bit.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\Driver\TechkonDriver64Bit.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServerApp.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDService.exe.config

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceConnection.dll

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TDServiceLogMonitor.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroDriveUpdate.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\TechkonSpectroJetUpdate.exe

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultScan.tss

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\defaultSpot.tss

C:\Program Files (x86)\TECHKON GmbH\TECHKON Device Service SDK\dzncore.dll

Windows Analysis Report
8ue90oYkrv.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre