Edit tour

Windows Analysis Report
HomeDesk.msi

Overview

General Information

Sample name:	HomeDesk.msi
Analysis ID:	1447353
MD5:	3e541108bd65df0d1127e15711da911a
SHA1:	eb6ae2a6dd97fa670dcae50daef8444b3ae14cc1
SHA256:	52459bfa76a1b8918e1e18c7b35b9a5ea0c4876e7483e2f486217e3059b6c234
Tags:	msi
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for dropped file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Launches processes in debugging mode, may be used to hinder debugging

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6504 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\HomeDesk.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6596 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6792 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1 MD5: 9D09DC1EDA745A5F87553048E57620CF)

LKdayanJELT9QDD900055.exe (PID: 2500 cmdline: "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe" MD5: EB67273C54E78DB4FAFFAB9001148753)

LKdayanJELT9QDD900055.exe (PID: 6524 cmdline: "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe" MD5: EB67273C54E78DB4FAFFAB9001148753)

LKdayanJELT9QDD900055.exe (PID: 4476 cmdline: "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe" MD5: EB67273C54E78DB4FAFFAB9001148753)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe, ProcessId: 2500, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Financeiro

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Avira: detection malicious, Label: ADWARE/NotToTrack.dzcps

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll	ReversingLabs: Detection: 21%
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Source: HomeDesk.msi

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Unpacked PE file: 5.2.LKdayanJELT9QDD900055.exe.400000.0.unpack

Source:

Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: HomeDesk.msi

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028AE3A0 FindFirstFileW,FindClose,	3_2_028AE3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028ADDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	3_2_028ADDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040E3A0 FindFirstFileW,FindClose,	5_2_0040E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040DDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3E3A0 FindFirstFileW,FindClose,	8_2_02C3E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C43CDA FindFirstFileW,	8_2_02C43CDA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	8_2_02C3DDBC

Source: global traffic

HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: newsfoos.from-il.comCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: newsfoos.from-il.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: newsfoos.from-il.com

Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php#
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.php&
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.phpN%
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://newsfoos.from-il.com/clientes/inspecionando.phpOI
Source: LKdayanJELT9QDD900055.exe, LKdayanJELT9QDD900055.exe, 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2036285297.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2038808113.000000007E290000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000003.2032891929.000000007E640000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2039755447.000000007EC70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D42000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/v03rLptMes/inspecionando.php

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C448D2 OpenClipboard,

8_2_02C448D2

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C4499A SetClipboardData,

8_2_02C4499A

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C445E2 GetClipboardData,

8_2_02C445E2

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C446BA GetKeyboardState,

8_2_02C446BA

System Summary

PE file contains section with special chars

Source: AGLoader.dll.1.dr	Static PE information: section name: .Lp&
Source: AGLoader.dll.1.dr	Static PE information: section name: .l)4

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C444A2 NtdllDefWindowProc_W,

8_2_02C444A2

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00ECBD43 __EH_prolog3_GS,SetErrorMode,__set_abort_behavior,_memset,CreateProcessAsUserA,CreateProcessA,

3_2_00ECBD43

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C4458A ExitWindowsEx,

8_2_02C4458A

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\53da2f.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDBB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDEA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF43.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE0BB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{CD47C468-A902-4164-B360-5693BA87F9BC}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE168.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\53da32.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\53da32.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIDD3D.tmp

Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDC0B4	3_2_00EDC0B4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EE7105	3_2_00EE7105
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EF12DA	3_2_00EF12DA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDB373	3_2_00EDB373
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDC4E9	3_2_00EDC4E9
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EF344A	3_2_00EF344A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00ED2672	3_2_00ED2672
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EE87DC	3_2_00EE87DC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00ED28C5	3_2_00ED28C5
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDB867	3_2_00EDB867
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EF184C	3_2_00EF184C
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00ED5A90	3_2_00ED5A90
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDEBDC	3_2_00EDEBDC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EE0B47	3_2_00EE0B47
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDBC7F	3_2_00EDBC7F
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EF0D68	3_2_00EF0D68
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EE2D1E	3_2_00EE2D1E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EF1FF6	3_2_00EF1FF6
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDAFC9	3_2_00EDAFC9
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028AC3B8	3_2_028AC3B8
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040C3B8	5_2_0040C3B8
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C432BB	8_2_02C432BB
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3C3B8	8_2_02C3C3B8

Source: Joe Sandbox View	Dropped File: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe 7FA7499C7A72041D7D0FB1E4659466AD8D428080A176FA16276FD60ADC9DA0FD
Source: Joe Sandbox View	Dropped File: C:\Windows\Installer\MSIDD3D.tmp 42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: String function: 00EDDFB0 appears 53 times
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: String function: 00ED8F00 appears 60 times
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: String function: 00ED8F33 appears 41 times

Source: AGLoader.dll.1.dr

Static PE information: Number of sections : 12 > 10

Source: HomeDesk.msi

Binary or memory string: OriginalFilenameAICustAct.dllF vs HomeDesk.msi

Source: classification engine

Classification label: mal88.evad.winMSI@8/142@1/1

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C43BBA AdjustTokenPrivileges,

8_2_02C43BBA

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C43D5A GetDiskFreeSpaceW,

8_2_02C43D5A

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle,

3_2_00ECBED0

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C44012 SizeofResource,

8_2_02C44012

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLE1C1.tmp

Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Mutant created: \Sessions\1\BaseNamedObjects\My-Ecommece

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF66716DC87A4382C0.TMP

Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Command line argument: >b

3_2_00EE6190

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HomeDesk.msi

ReversingLabs: Detection: 31%

Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-DANO-ADD
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-DANO-ADD
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-b-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: jp-ocr-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: ISO_6937-2-add
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-SEFI-ADD
Source: LKdayanJELT9QDD900055.exe	String found in binary or memory: NATS-DANO-ADD

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\HomeDesk.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: unknown	Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: unknown	Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: agloader.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: agloader.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: agloader.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: HomeDesk.msi

Static file information: File size 23561216 > 1048576

Source:

Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: HomeDesk.msi

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Unpacked PE file: 5.2.LKdayanJELT9QDD900055.exe.400000.0.unpack

Source: initial sample

Static PE information: section where entry point is pointing to: .l)4

Source: AGLoader.dll.1.dr	Static PE information: section name: .didata
Source: AGLoader.dll.1.dr	Static PE information: section name: .Lp&
Source: AGLoader.dll.1.dr	Static PE information: section name: .LaQ
Source: AGLoader.dll.1.dr	Static PE information: section name: .l)4

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDF974 push edi; ret	3_2_00EDF976
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDFA7F push esi; ret	3_2_00EDFA8F
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDFC68 push esi; ret	3_2_00EDFC6A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDFD51 push edi; ret	3_2_00EDFD53
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00ED8ECE push ecx; ret	3_2_00ED8EE1
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDDFF5 push ecx; ret	3_2_00EDE008
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028B0020 push ecx; mov dword ptr [esp], edx	3_2_028B0021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028AF114 push ecx; mov dword ptr [esp], eax	3_2_028AF119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028ABA24 push ecx; mov dword ptr [esp], edx	3_2_028ABA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028A6DF9 pushfd ; retf	3_2_028A6E03
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_00410020 push ecx; mov dword ptr [esp], edx	5_2_00410021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040F114 push ecx; mov dword ptr [esp], eax	5_2_0040F119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040BA24 push ecx; mov dword ptr [esp], edx	5_2_0040BA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_00406DF9 pushfd ; retf	5_2_00406E03
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C40020 push ecx; mov dword ptr [esp], edx	8_2_02C40021
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C35113 push ecx; ret	8_2_02C35114
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3F114 push ecx; mov dword ptr [esp], eax	8_2_02C3F119
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3178B push dword ptr [eax+1Ah]; ret	8_2_02C317BA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C334D7 push esp; ret	8_2_02C334E5
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C33467 push dword ptr [edi+3Ah]; ret	8_2_02C3347E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C42438 push ecx; mov dword ptr [esp], edx	8_2_02C42439
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C4256C push ecx; mov dword ptr [esp], ecx	8_2_02C42571
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3BA24 push ecx; mov dword ptr [esp], edx	8_2_02C3BA25
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C34B5F push 33F86C61h; ret	8_2_02C34B64
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C31849 push ds; ret	8_2_02C3184A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C31851 push ds; ret	8_2_02C31852
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C31858 push ds; ret	8_2_02C3185A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C31839 push ds; ret	8_2_02C3183A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C439E8 push 10E40002h; ret	8_2_02C439ED
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C36DF9 pushfd ; retf	8_2_02C36E03

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDEA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE0BB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDEA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE0BB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF43.tmp	Jump to dropped file

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Financeiro			Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Financeiro			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 5C0005 value: E9 8B 2F 94 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 76F02F90 value: E9 7A D0 6B 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 5D0005 value: E9 2B BA 8F 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 76ECBA30 value: E9 DA 45 70 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 5E0008 value: E9 8B 8E 93 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 76F18E90 value: E9 80 71 6C 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 600005 value: E9 8B 4D 5F 75	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 75BF4D90 value: E9 7A B2 A0 8A	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 610005 value: E9 EB EB 5F 75	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 75C0EBF0 value: E9 1A 14 A0 8A	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 620005 value: E9 8B 8A 9B 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 74FD8A90 value: E9 7A 75 64 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 630005 value: E9 2B 02 9D 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 2500 base: 75000230 value: E9 DA FD 62 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E20005 value: E9 8B 2F 0E 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 76F02F90 value: E9 7A D0 F1 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E30005 value: E9 2B BA 09 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 76ECBA30 value: E9 DA 45 F6 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E40008 value: E9 8B 8E 0D 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 76F18E90 value: E9 80 71 F2 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E70005 value: E9 8B 4D D8 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 75BF4D90 value: E9 7A B2 27 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E80005 value: E9 EB EB D8 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 75C0EBF0 value: E9 1A 14 27 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: E90005 value: E9 8B 8A 14 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 74FD8A90 value: E9 7A 75 EB 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: EA0005 value: E9 2B 02 16 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 6524 base: 75000230 value: E9 DA FD E9 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: A10005 value: E9 8B 2F 4F 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 76F02F90 value: E9 7A D0 B0 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: A20005 value: E9 2B BA 4A 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 76ECBA30 value: E9 DA 45 B5 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: A30008 value: E9 8B 8E 4E 76	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 76F18E90 value: E9 80 71 B1 89	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: E70005 value: E9 8B 4D D8 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 75BF4D90 value: E9 7A B2 27 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: E80005 value: E9 EB EB D8 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 75C0EBF0 value: E9 1A 14 27 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: E90005 value: E9 8B 8A 14 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 74FD8A90 value: E9 7A 75 EB 8B	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: EB0005 value: E9 2B 02 15 74	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Memory written: PID: 4476 base: 75000230 value: E9 DA FD EA 8B	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C44832 IsIconic,

8_2_02C44832

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00EDAFC9 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00EDAFC9

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle,

3_2_00ECBED0

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Window / User API: foregroundWindowGot 361

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDD3D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDDEA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE0BB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDDBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDF43.tmp	Jump to dropped file

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API coverage: 7.9 %
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API coverage: 5.7 %
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API coverage: 2.5 %

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028AE3A0 FindFirstFileW,FindClose,	3_2_028AE3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_028ADDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	3_2_028ADDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040E3A0 FindFirstFileW,FindClose,	5_2_0040E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 5_2_0040DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040DDBC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3E3A0 FindFirstFileW,FindClose,	8_2_02C3E3A0
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C43CDA FindFirstFileW,	8_2_02C43CDA
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 8_2_02C3DDBC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	8_2_02C3DDBC

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_028AFFB8 GetSystemInfo,

3_2_028AFFB8

Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.00000000006B2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_3-33334
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_3-33654
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_5-8217
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_5-6761
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_5-7949
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_5-6636
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_5-7388
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_8-14725
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	API call chain: ExitProcess graph end node	graph_8-14629

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00EE6408 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_00EE6408

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

3_2_00EE6408

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00ECBED0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,Process32Next,CloseHandle,

3_2_00ECBED0

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00EDD605 GetProcessHeap,

3_2_00EDD605

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe "C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"

Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00ED07FC __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z,__EH_prolog3_catch,SetErrorMode,__set_abort_behavior,SetUnhandledExceptionFilter,__set_invalid_parameter_handler,__set_invalid_parameter_handler,__set_abort_behavior,_signal,_signal,_signal,_signal,_signal,_signal,	3_2_00ED07FC
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDB285 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00EDB285
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: 3_2_00EDB254 SetUnhandledExceptionFilter,	3_2_00EDB254

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C44AEA keybd_event,

8_2_02C44AEA

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C44AF2 mouse_event,

8_2_02C44AF2

Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROGRAM MANAGER
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROGRAM MANAGER)
Source: LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D7C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerVO

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00EDE4AA cpuid

3_2_00EDE4AA

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00EEF0B3
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00EEF1DD
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	3_2_00EEF28A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	3_2_00EEF35E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00EED6C4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	3_2_00EEEB0A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetLocaleInfoW,	3_2_00EDCC65
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: EnumSystemLocalesW,	3_2_00EDCC28
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00EEEDBE
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: EnumSystemLocalesW,	3_2_00EEED7E
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00EEEEBE
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00EEEE3B
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	3_2_028AE4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_028AD958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetLocaleInfoW,	5_2_0042F000
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0040D958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	5_2_0040E4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: EnumSystemLocalesW,	8_2_02C5F204
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	8_2_02C3E4F4
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_02C3D958
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetLocaleInfoW,	8_2_02C43D9A
Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	Code function: GetLocaleInfoW,	8_2_02C43DA2

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_00EDDE45 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00EDDE45

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 8_2_02C43E9A GetTimeZoneInformation,

8_2_02C43E9A

Source: C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Code function: 3_2_028AFFCC GetVersion,

3_2_028AFFCC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	1 Replication Through Removable Media	Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	11 Input Capture	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	11 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Process Injection	1 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HomeDesk.msi	32%	ReversingLabs	Win32.Adware.NotToTrack

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	100%	Avira	ADWARE/NotToTrack.dzcps
C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll	100%	Joe Sandbox ML
C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll	21%	ReversingLabs
C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	58%	ReversingLabs	Win32.Adware.NotToTrack
C:\Windows\Installer\MSIDD3D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDDBB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDDEA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDF43.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE0BB.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.indyproject.org/	0%	URL Reputation	safe
http://newsfoos.from-il.com/clientes/inspecionando.php&	0%	Avira URL Cloud	safe
http://newsfoos.from-il.com/clientes/inspecionando.phpOI	0%	Avira URL Cloud	safe
https://pastebin.com/raw/v03rLptMes/inspecionando.php	0%	Avira URL Cloud	safe
http://newsfoos.from-il.com/clientes/inspecionando.php	0%	Avira URL Cloud	safe
http://newsfoos.from-il.com/clientes/inspecionando.php#	0%	Avira URL Cloud	safe
http://newsfoos.from-il.com/clientes/inspecionando.phpN%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newsfoos.from-il.com	35.199.75.136	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://newsfoos.from-il.com/clientes/inspecionando.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://newsfoos.from-il.com/clientes/inspecionando.phpN%	LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/v03rLptMes/inspecionando.php	LKdayanJELT9QDD900055.exe, 00000003.00000002.2906804901.0000000002D42000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	LKdayanJELT9QDD900055.exe, LKdayanJELT9QDD900055.exe, 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2036285297.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2038808113.000000007E290000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000003.2032891929.000000007E640000.00000004.00001000.00020000.00000000.sdmp, LKdayanJELT9QDD900055.exe, 00000008.00000002.2039755447.000000007EC70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://newsfoos.from-il.com/clientes/inspecionando.php#	LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://newsfoos.from-il.com/clientes/inspecionando.php&	LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://newsfoos.from-il.com/clientes/inspecionando.phpOI	LKdayanJELT9QDD900055.exe, 00000003.00000002.2904904326.0000000000697000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
35.199.75.136	newsfoos.from-il.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447353
Start date and time:	2024-05-24 21:20:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HomeDesk.msi
Detection:	MAL
Classification:	mal88.evad.winMSI@8/142@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: HomeDesk.msi

Simulations

Behavior and APIs

Time	Type	Description
20:21:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Financeiro C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe
20:21:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Financeiro C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe	AFATS317052024.msi	Get hash	malicious	Unknown	Browse
	z62DEBT3042024.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-39873.msi	Get hash	malicious	Unknown	Browse
	fatKCMAGKKH.msi	Get hash	malicious	Unknown	Browse
	danfe678478.msi	Get hash	malicious	Unknown	Browse
	Fat012024.msi	Get hash	malicious	Unknown	Browse
C:\Windows\Installer\MSIDD3D.tmp	z1Pedido-Faturado-NF-938731.cmd	Get hash	malicious	Unknown	Browse
	arquivo.msi	Get hash	malicious	Unknown	Browse
	25690.01808D.msi	Get hash	malicious	Unknown	Browse
	fatKCMAGKKH.msi	Get hash	malicious	Unknown	Browse
	SPMServer_2024.3.5.473.exe	Get hash	malicious	Unknown	Browse
	SPMServer_2024.2.1.7.exe	Get hash	malicious	Unknown	Browse
	SPMServer_2024.3.1.22.exe	Get hash	malicious	Unknown	Browse
	Df.mes-25664.msi	Get hash	malicious	Unknown	Browse
	FatRE012024.msi	Get hash	malicious	Unknown	Browse
	Fat012024.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\53da31.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	18477
Entropy (8bit):	5.506819391825574
Encrypted:	false
SSDEEP:	96:8Zx/iAlAq0ny84PTqSYVlMLFa8F1i6nj1i2UpgvUjQqTCYThqr5UpgvUjQqTCGjY:876oTqSYXM/1iW4XnOE3nOhd3/pSl8
MD5:	06CB062114DA9BFF18932880A51A5E28
SHA1:	1AD68536737EF2808D6ECB4C27AC9295040BF429
SHA-256:	E7661B978F3A7E65C096041329619D2C9CAFF4068B179F2F42FD249FD68630DE
SHA-512:	4F5CD9B4B08CB2A43D01B2BD88C12CC8E3E1CDA026763E959E0B065A9D85925D5548A5BFE80D9446BDC840AEF2071D7AFD4FF909DCE761BE493A78B80CB51E23
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.X.@.....@.....@.....@.....@.....@......&.{CD47C468-A902-4164-B360-5693BA87F9BC}..Nota Fiscal Eletronica..HomeDesk.msi.@.....@.....@.....@........&.{16DCA61C-6A0D-4F02-A29D-AC9E50B5C214}.....@.....@.....@.....@.......@.....@.....@.......@......Nota Fiscal Eletronica......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]....ProcessComponents%.Atualizando o registro de componentes..&.{5B9BF2B6-368C-4FE3-B208-7E54B76F1DBD}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@......&.{04467034-B5F7-4AE8-BA26-EE0FA212F939}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@......&.{76FA10C0-C859-48B5-A751-C686F58B6972}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@......&.{24CFBDBC-C785-4A5E-BCD6-EA8F672F9DA8}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@......&.{09251714-0327-4851-9BB9-2D74FB04B383}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@......&.{0F02F704-3922-4024-BF11-E102C1B881F2}&.{CD47C468-A902-4164-B360-5693BA87F9BC}.@........CreateF

C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11121664
Entropy (8bit):	7.945061264661172
Encrypted:	false
SSDEEP:	196608:kg/hSlaa4caNLQb9AYAXYmkJXwOBYkYTWprBJuefdDIyb7QmsLusda+i/jr:j/hSlwcaNsjm0YCprBjfBLQ7TArX
MD5:	EB77A874ABBD9BA3DAFA46CF1B7FF686
SHA1:	445F040A12BADA9F7CC1B5791551ADAE4AAA382F
SHA-256:	9F2281DF855C4CD8A66591A7328DA0C73860BEA35E89AD01DD0A80C207520815
SHA-512:	07C3EF5ED8D43DB61C1A585CC716A1E348CF9329B56BFDFFC02C58373E7E3F84B8F495D08F74DA9E08E3AF8E8288DACE2F1216B13E7E61CBAF23F63DEDFBF574
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L....TNf...........!.................C............@.......................................@...........................v......e..d...............................(.....................................................n.$............................text...@........................... ..`.itext..8........................... ..`.data....P..........................@....bss.....i...p...........................idata..(...........................@....didata.............................@....edata..............................@..@.rdata..E...........................@..@.Lp&....@.^.. ...................... ..`.LaQ....<.....n.....................@....l)4....`.....n..................... ..`.reloc..(...........................@..B....................................................................................@..@........................................................

C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295944
Entropy (8bit):	6.59442664366273
Encrypted:	false
SSDEEP:	6144:slR5gD9yOvDIxyVQN8cnqDt+T1MLFUM8O:sRgD9iGQyFET1MLD8O
MD5:	EB67273C54E78DB4FAFFAB9001148753
SHA1:	0E6CAB2FDF666E53C994718477068E51B656E078
SHA-256:	7FA7499C7A72041D7D0FB1E4659466AD8D428080A176FA16276FD60ADC9DA0FD
SHA-512:	8FCAE871423C03850787CDC62F9E2555B054A8480772003FBFA5799AE7359C438D9F64C95592D265328909863FD000D6CDB4B34A6A8810045BC4029F23F6BD07
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Joe Sandbox View:	Filename: AFATS317052024.msi, Detection: malicious, Browse Filename: z62DEBT3042024.msi, Detection: malicious, Browse Filename: Pedido-Faturado-398731.msi, Detection: malicious, Browse Filename: Pedido-Faturado-398731.msi, Detection: malicious, Browse Filename: Pedido-Faturado-39873.msi, Detection: malicious, Browse Filename: fatKCMAGKKH.msi, Detection: malicious, Browse Filename: danfe678478.msi, Detection: malicious, Browse Filename: Fat012024.msi, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4)..UG.UG.UG....UG.....UG....uUG.e...UG.UF..UG....UG....UG....UG....UG.Rich.UG.........................PE..L.....GX.................L...<......%P.......`....@.................................q.....@.............................k.......d....................f..................................................@............`..x............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data....G...0..."..................@....rsrc................4..............@..@.reloc...........0...6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103983
Entropy (8bit):	7.998338521209024
Encrypted:	true
SSDEEP:	1536:BW6uIWYmeDQymkE1pdtZtudaj7guiIOWUWeIIYUda3GsG6+7Alf1:o2WYLDKv9tZkdwiIOdcIv2R/+7A91
MD5:	F3E2E17C9D9D0A2A617D5191C52B2A46
SHA1:	A8C71D1726E88CB212D5CAF85F22161889425CD5
SHA-256:	68D812F6F5332E25299A988317E00E232E77C976E1325DD482D199E14B4C0A94
SHA-512:	ACA15110ABC4C6EC68D77530EC7AD28C52C251B93D8BE8AF7DA5D3D837B446D28D783D47F726B9F1BD6412E950379FDDC5457BA6E642D65C20971F89425E68F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	72670
Entropy (8bit):	7.997561227399474
Encrypted:	true
SSDEEP:	1536:BW6dODTVkPr4Aqr6l32rDHIGJrM0lEbCze4lL7p:ofcks2rcu5Kbye4z
MD5:	A1273F0C3285077283ACECA12E6441CF
SHA1:	D0A3059C109592E207C2A959D7006E66D16079AD
SHA-256:	6018FC0C419711176481E092C6268198EC4AF0979FA020A41F7317589D720592
SHA-512:	245579D00432D1A96A463F262DA6706E48FF7B810454C7806832CA964125733D0330213AEE36503EB4224D60DD42419E14F5B2566E8BC50362ABA18FFE31CCA4
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	79550
Entropy (8bit):	7.997580721217276
Encrypted:	true
SSDEEP:	1536:TKj2za98A5BSKR2yhF074MeSHuhdefgHXQS+eayU:Gj2W2A07teWqQfagYU
MD5:	33D4E72700DE06616773F322FFEADE23
SHA1:	DFB9AF6B852B7C75861AB231524626539EFE98EC
SHA-256:	15FAF32B447CF64F47117812ADDCC5EE4A9E654F062508A14E745E4A4A8D82AF
SHA-512:	A07DD5836A03BD50FD1F3A35FBFE2693A1EF12B1AC49FAFD3FA5DB42FEA0CA4D96B3306C5F78DB6014E924364805D852A4CE61ED7B438759C8D76410AEF24EBE
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;...j@{..`..9.<(...../x...6.Z.......'.9...5....z.v.gJ..Yq.+.._..4.3.....X..(VPV..{......R"x...00. y7.P.R.[2..!...+...ZY...V.....M.f......\S..B...bz..s...f.4gc....H..O.G...9,.........A.l.....=m.:.'.Mt..c....9..5...'..U@^.gC.9.@M=...y..h..%..n)n.!.j.V..Wx.y@W...}}.T..>}.......f..2e%:X....#..0.k.."g.>,.`.....Gi.I.....b..?...h.N.+..6~Jz... A}..c......;Y..A...M..q)Y.A...."q..'.......?....o.o...;T.k.%R.j._..$....<9t...".7.....F5`.l.......@.@a#....ixDh.F.;........2.&f..c7........p..`.$.Pd+.w...;..)t.N...B...^n..K..:NL.ot.)".DZ...j'O.L\|..^....~N]@.O..-0..z...T.i.rr.M.v9j..s.......N..\|q).+....f.TV..j....z.....t......0.......w.y........f.S[E.[!..@..Q..w...c.j.~.Oa..0...Ci...jLT3:g.Oq^...+.........7......2..Bh./B..7.....k.F...L...S.....w.@$.....5.d...g\|.h:_g...t.8p..u.....>..+.]i..f..Z..d...,.(.h3.q.....2L.N.W....5$k[.....V.P@.M=...Q....h..'F.oDL>vpCWU.]JkJ...lc.KVC..).`L..mg............:.\|..4...D.:J.bZ.wO...64....ZIg...-O

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	90741
Entropy (8bit):	7.99772780022569
Encrypted:	true
SSDEEP:	1536:BW68pTu/DzylC/KrWuo2kqy/31NftiQZs/Ye4Y0oD65WxEw9HNDE7:oJpTQz6C/KKpz58Ks/f44G5WxEIJy
MD5:	31BE227EBD00EB32E0D97C03547953AA
SHA1:	29B9357D45D7B9417E8D701562DF4ECF029AA235
SHA-256:	2ABD44444B428A8438980C23290653818567A1C52A6F6E28CD582F02ED7A1997
SHA-512:	8962F0F3D09CE5FCEC54C4C311593A53BF8C5510E9558D1D2AA17539F55CD9362DD44FEBAFDE2FA9FA2DF92FFC7FBB4AACC54971829ECE6F0A368E237D59F5FD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	23014
Entropy (8bit):	7.993330995993904
Encrypted:	true
SSDEEP:	384:BW6Npc2cLZYGT+bJP89WYiJJbfSvNUUi9++4qEiEyJ8B0ih/n2:BW6Npchus+bJP8wLf7U8F2iR40Y/n2
MD5:	3F07A14138725B4FEA87018778E99C9D
SHA1:	E9476B1F97D68E4B041CE45B3AC8B367FDA9AE73
SHA-256:	884AF08E980F32A5D857AEF65E94D692CC5179F0298151CB3EEE28307D5294C3
SHA-512:	5621FB39A236BB634E8E2C99237592532B914DC532D23922410615FA7D4D41B7A8452AB2BA318DEF99910FF72C9BF212BE463EB0C34D91DF85900F37136C059E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64412
Entropy (8bit):	7.997009584668567
Encrypted:	true
SSDEEP:	1536:BW6+yg8Lks0LNMax67S2fSMxkTo+Oh/GFjlC1f4CO8RkY7H2JUkgGiXPwbj4:op8gsg5xYS2q9TzOHOCO8RNH2JUPGiXx
MD5:	C5A27652BFEF12D580F8C7D9278BFB56
SHA1:	B8FA94A092969B00A2CA49AADE501F86C7D05124
SHA-256:	84239C96D1A3EEA8F4A1131EE859C70863D2D2FF981DB955A204D06FB3E399F9
SHA-512:	93485D1AAFFD03E2B9BDF8AC519B4A1B2F9504B7DECE5A72E93BD78D7C1EAF287D347D6B0088CB665395B2099C9DE8285444986DAF6955C984B4BD0447679C99
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv10.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53999
Entropy (8bit):	7.996770426163462
Encrypted:	true
SSDEEP:	1536:BW6XYLT5F0YEIefnYXpZZ878ZUqvsLj+LCGHiGP:o1H5JEIefIp7U8V0Lj+LCA
MD5:	21A9EE4A323D30EBF01E909E0D2458DD
SHA1:	B1FF6EF537D741A21DE4C9940711E5403CB95154
SHA-256:	84FF014DDE709723B41574356866AE44A9C31FBE172719091AF2F7C211F515C5
SHA-512:	8376BE074DDCCD81B0B512F45D22C96D4DF2CB2BC28051977B489784E9A96BE195BC451BA34D010EC006817843525090B99323B2FA171396E0554F5752F15A47
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv10.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32176
Entropy (8bit):	7.995349694654279
Encrypted:	true
SSDEEP:	768:BW6N0QSaME0UDtQrJ06y1AdWkYnAC67Ho77gDtUcJydY7AxG8OGY1kbJ7:BW6PSaMc5Qr+Oul77gpUckoOOBCbB
MD5:	0F47D734176C343CF3FBE700D08D0062
SHA1:	5D33092BE18F4EA93B82B852B806436AB9AAE103
SHA-256:	61D82DE1D9F5DF0B5F96C7F4E1CB249E3A41A49A3225FA2C58E781E0AA8AC351
SHA-512:	CB602DAAD0CC177BAA032389842F9D47D4D3085363875FAD9947FC735E8DD883C558EB35F4C944B340A25A3F15768FF3084ACB3622224516DA3D046E0E6ADE68
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv11.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103698
Entropy (8bit):	7.997954975179584
Encrypted:	true
SSDEEP:	3072:onCjBvz5FE815qPXpDm/1pJUEOYMKzxhqZRgSgfXU5:TjBvzrEY5qPXpD4TJLM6NU5
MD5:	D5607B6BF989EF431346619F0D81D09F
SHA1:	7C9606C08F7EE8176948A694BF36ED7BEF058571
SHA-256:	C8E14FDE2559E6F71CA0CF023D2CC51636E171B206CAEFC11DEF6045D98E66A1
SHA-512:	E92948490B261A222FD26237CC3A94E68EC561EE42B0ED2D54267EB0A17CB1A8B4BFB0DC2474E6945D6BB6E6A3062B55A875A445CCF265A225390C3537F6BDE1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv11.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36816
Entropy (8bit):	7.995057511765618
Encrypted:	true
SSDEEP:	768:BW6NKcj+tNNn72mIuTvBvWG4q8hQP7eW5QJsdU9Q9qRpK8vP1O9:BW6yfB7nFvaQTeaBUQqDK8u
MD5:	8912777F68DD57322A21A454A3038289
SHA1:	F7373B9BF2C1BE2542144873D904D3205514F13E
SHA-256:	26F01B5F8468B8E78D88232717D2785C9EAEC35F239820AFB0DDA382297A0830
SHA-512:	B5D0AC28F90B07F4C02CC1CE80351970767E77962C1E6065240D3224E9AA42F7DD8BC016029459E3837912BEDD40DF63A1A5513E17BC45DF1F9AACE133F2F7F2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv12.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89867
Entropy (8bit):	7.997920440624809
Encrypted:	true
SSDEEP:	1536:BW6/ECkXeC2oyI7arfNZ9kst46VHoxTlC3Vvz+/1ELZiK5Y1NvJMFF7JLwqyrnVQ:ocrkos7Wpt46VHoxTcVq/1ELZikUvJMr
MD5:	5056454E25D9DA771B1927ED97BFAF0D
SHA1:	1A7E91BE971E815071A58C54BA57B9FB613DFDDB
SHA-256:	EDCAF92F597D225DB49C4DF56300BF4962177B689409758571790DAF262575CA
SHA-512:	67A0322E0E9C1C6D06235C43C57BB85BCB20156B292989A963D598D4801B36AF9A255427D6A3891347BAB88614FD1E1556C44FD143D2D7131A713C025ED8E202
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv12.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30981
Entropy (8bit):	7.994864854434588
Encrypted:	true
SSDEEP:	768:BW6NgZIbV8Eyzb56mJ/dc7F1Jc+rtiStdtL:BW6m+xVyn5lldSF1JpDtL
MD5:	56D17C7CB534DD8290971648EAEF4B84
SHA1:	AA757929675926B17D02078C69F0F3B4972C6E18
SHA-256:	7860C45AB4056B141C9031E95F2E93E852531D1AA03B4E5FD6164C6C4E812C64
SHA-512:	6340A31150A45DEA1E367319F18BD2FE6C6BEB7CB975638935B28D95514091BF6E48DB8B8E9060F96A621BC00EF5F57237BD0F13549EFA0024298CF069A02D0F
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv13.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100846
Entropy (8bit):	7.998158896251984
Encrypted:	true
SSDEEP:	3072:odWE3d6L0GenMnlMkDVZI8+NOqKzazG5zsPfeT5yw:YVrhA1DVZIhkN1zseTx
MD5:	91EC970B7C15E11680F47A1413B72962
SHA1:	339B0A308CD1F5B4174F7F43999A4281C205503B
SHA-256:	6BF4C19E221830BD5BABCAC9F92089A656882E3793FC69879D804788960FD223
SHA-512:	4226E840940163B0525EEAA9D372C8247F9CBC2D84068E0EFB9A01D2D8B118D50C9351BF077F5C865BD3A9359F560792A3483933806583602CFA79731E118834
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv13.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33480
Entropy (8bit):	7.995378671824126
Encrypted:	true
SSDEEP:	768:BW6N286l4XkLghjeSo6+pEVf4J1wAJ/G7mRlgW6WsvV0YYQ:BW6zhilLD11e7fWBsvVpYQ
MD5:	76865ECCE4C30C2536236ED171A0D76E
SHA1:	B5E5C62D55D317D1D7F77915C5738A8635C82C9C
SHA-256:	C7B799B3DEE229B709AD9DAE5E029FA5A7D7BE8BE0454F49527B632C07D9F625
SHA-512:	B585721BE72E8BE50CB13C2EB0F3A80AA85A17FC49C542E95BFBFCBC898F09E6BC370388FB583F1CC2D216A37834CC3F7C7BEBFACE45F68F037133ACE812A90D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv14.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	101922
Entropy (8bit):	7.997980089704199
Encrypted:	true
SSDEEP:	3072:ozGLP4gGk7MqyFe+v5FSXq8vymH3AhLBvVu53s:c2Mqy00FSVbXAhK53s
MD5:	3D8772A6F26F6BAAD2715A514D7A419D
SHA1:	5062988072F8CC660EAD6BB5BC7767EBD68705E3
SHA-256:	8FA4E1AF5CBF40A9A52A718BD43EF4C089632E732B1EAC5299E73994E947B219
SHA-512:	C96969F7A0F509B39DF3378600A1F83AA1E72B62FD2CA7AB23880A10A60D1D05D368500E385E31EFDA7D6B21E4F038F0F55AB88AD8ABD4966568F0DA78711BCD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv14.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34450
Entropy (8bit):	7.993568193715657
Encrypted:	true
SSDEEP:	768:BW6NxQk/u3KCN5PkV12Ms5n9wclxmgWwiApAQAgnus5lUZgsqK:BW6sk/uNN5Pkf2fnnNi0FAgnusrmSK
MD5:	20354B294A886DE9EED65C05B8B4E0EA
SHA1:	FDB0C9C8E67DC389C3D33BFEAA45B11EADE89B37
SHA-256:	3B01077CB6F2B33E1FD4B44D6F8FCB2144840AB59E819665B331CBB753E1DD1D
SHA-512:	6AFC0716FD5CA327A20E1B91138D7840F741943552C72D4BED4F91D97E685F245D3085848C548A0875455C54646A95B085C49737A8820F71C4D2AF87519C760A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv15.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	94880
Entropy (8bit):	7.998273684433496
Encrypted:	true
SSDEEP:	1536:BW6ki9VOORyBJuKi8oWqJB9DTEhIr9i854OjWihTenAmM6EUKUT+hH9FtqsaQD1:oq9VOTBJuKi8oWqJB9DTECQ9OjWihgwL
MD5:	D7901A0FB829DB040107D2C02943A4D6
SHA1:	18A852B5DA7A2B57A6154C83C80F62ED67570791
SHA-256:	E2F925AA3AF7174F26E96571038AB83FC1D1D8F4F5A2EB1C48C654EDA1E6A2D1
SHA-512:	BE831DCD06567A2F9A23988086BEB16880847879626ACE28208F0BF2EC99883C26C326F708D6BDDFB5BD97D476AE119135682B2FC9571B990376B74260CD0725
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv15.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34480
Entropy (8bit):	7.9953759299235685
Encrypted:	true
SSDEEP:	768:BW6Naojf7WVL3er0d3esbt78wNXg6w1E0xLmPSpJW5aBG:BW6wojDM3er0dRuaQ9XbDG
MD5:	490064B278F31F395A1D93488FE7417C
SHA1:	85F0BAEABE880AEC6324E2D994BAA37235C8F260
SHA-256:	30DEFE60FF9390B8B828759FBF90B152A8F8BE7423258897E31712E27AA18463
SHA-512:	A0001C53159AD3A033D53FCC86A7DF622C4313938674DBE58951915D212058829C031EBE7AAAFE06EE998A4037FBADE880FAA9957EEE6F6AC4CED272D7162971
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv16.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	97471
Entropy (8bit):	7.997963841827689
Encrypted:	true
SSDEEP:	1536:BW6XaXXzu+S2cEfzIaUU4EHvAQq5xoJOzift1Y//H7PzqmsKW+pQEtrJookIbC:oLu+SPKES4EHvA15OEuf2Dns4pQEYok3
MD5:	7E93CE1B4A288A0764CAB1A866932F7D
SHA1:	1EEE7FCFA3EDACB29875BCA791855FE5327ECA0B
SHA-256:	F6D10BF1489717408DC6F215A3996AE1C666D50FEC1AB4D80D84C0BF0D8F28A6
SHA-512:	7BC1C0130184686025A6E367E56C74848778C27C166A815FE25D410D1C2B1F75616DB95E6596072242B0C3CF431938E4D339292DEA515D3214D6CC8C9A1A87A6
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv16.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37147
Entropy (8bit):	7.994941099826608
Encrypted:	true
SSDEEP:	768:BW6NWTnwyRRds+R5aAqqp7E0m5CZkpmyWj8AQtOjY/Eob0xqucr0ULBnT:BW6unx/6+R59qqn9tj8AQoY/EdAhr0QT
MD5:	3E9FF1A1C7D11B406196267E0C1FE54B
SHA1:	539E9238F09C47E907E428B3F9C993A74E3A89F2
SHA-256:	B87FD006B7A4B7CA41B0C0C836636CDC46A1B87AB8BB0C17C0380FA42BC40E05
SHA-512:	D3071B70A00F40927EF048DE939E35BD22234F41CF6069196DF967326835EED9FFD77F5964008EE3906A439DEE7FEE9C0E6A1C6061D1332BC1C32A6B592AEA3E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv17.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	108523
Entropy (8bit):	7.998242819406155
Encrypted:	true
SSDEEP:	3072:onFeB6AcOWd374OzOHlh6Hy00+GJTNo/y:4STDvMChJBOy
MD5:	B954EE1D0DDBD6917660F9C3BD90703A
SHA1:	D21DFBB906266FCB3569968A706DAEE6BC399176
SHA-256:	AA5EFEE8E48E66DDF491A2F253ABE81E304E36A8F9A2A45B54F0C7F415D70582
SHA-512:	70E00C351D8AC5215C4865C6ED196008D6267CF0CFA463524814B6761E807A6A07850749334594E13F98FD6D2A8706DA7EFCEE6421A49CA699234F9770D38856
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv17.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	41834
Entropy (8bit):	7.995867858033007
Encrypted:	true
SSDEEP:	768:BW6NwIdvCYp/JggXqA+ymRuElNDsCDD7KZblz1rs:BW6a+CKJgbru8XDD7KLzW
MD5:	199C9F4ACDC95653F0741CD7BBED72E7
SHA1:	872E1E241DA7FAB037DB2C8C855B02C25CF29C94
SHA-256:	E77435E9B11AE1A2A014EE878F069BDD9198ED746CBACA50AD334020125858EC
SHA-512:	4C458E9E6B8C10EBE868BF6FA8CF62EB8F8EB8BE664BC9F2DEB61E5AE371891BB6554407D6DE158796420F7EC67A24E05D244E181D64835922586511BA81C2F3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv18.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	91207
Entropy (8bit):	7.998041486799748
Encrypted:	true
SSDEEP:	1536:AohPjAwtlx9NE0xivxzsyvfVZq2vJbKRypOHsDEO1TDnjsX12j:A+PsWl7NhCWy1BqMDJ1noXsj
MD5:	55023E704F32EB3F068C673D0FEA18CB
SHA1:	D20D01F61ACA12CB38E9C62737A895FFDDCF6A4E
SHA-256:	96C294875C7A8068301FB076CFC5DEFD26DF7B47AD875F6804886D0E374DD725
SHA-512:	1D8E2326C19FC3818AB0860ED0665F870550CD6E83DDE9856A344407484FFDA919E8FF63549F0EFDF1D0BCA2ADAA5E86A3D70735C52767E860DE191D391DBE19
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7Zc..\|..9."....V.<{%....x......J....l...u..a...lt49O.B8.k. .Y.&\..P..b..V..!..!"..f..5......F/n..<q.l....y:..t.qc...ng.,..............8."....7.H...B....i..V........m4..C!.\|-[.J<.f...#p.rTW.....N.t......GbT...Tc.Vk..`.....+........m.VM3....Ij.,.{e..)0.l..\9.....Z.`.....u.........-v.k.Cc.a.p.....SZ8.....= ..:..<.NO....;.0i.A~.C....[V..\|0.m#R.k.8..D....m..(Gk...,...'.nY4~..+z.......<ih..C....C.u.;&.00"....w...4..d.!f..._..Y+!0......u.\|.S.....9.......e=[....s....U..@.A...q.*.k1...b,p@..L..O.....O^>.AC...4zu...c:..6.....U%:_.b\/.....>.l..T.w..~.....`...E.J...`.}.`..wt_qQ..T/.a......Fl6..MV.U.5f#C.......`.E%.l......W....RB+.>+%.2/t.+.f....x....A...b.A....?7.....2............U.RD...\I..Vga...}...JF%....hN=...;........?....n:$...$S.P............{....F8..#...f...3.:Gc.X.....bg..b.ZL.....= 9.1p.)...d..W.Hq}.FmxP.s.t.....7......bkr.P.....O...W....:,...t...&.+..i.,/..w...d.......!..{/..Q.Q...._

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv18.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	70067
Entropy (8bit):	7.997558546255013
Encrypted:	true
SSDEEP:	1536:LEdkDhpUE4wxgU8wrLdymUCTWUMcLYJ5npJ:Yulp8wFgmUCKPcL8P
MD5:	26E1D8BF489FA30F98149CF812E0A1D2
SHA1:	3C063A89D5D9E18CAF21E35C398FD50E09D9426A
SHA-256:	340B5EA15AAC2496C69567327F34EB33E1AF6FC4BD8201B81E32A3816B475826
SHA-512:	BACB0C82B889AFC2DDC001D38CEAE7067204802F03A4AB7818888509007B1E70028BFC5A9C1C3C657C56BD6E0CE12DA7EE306B21D277D6B83F4FA05A93829963
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7Y...y+.....e.'...v).....5..'.{.?.K...+E.u........f/. \....$..@.......O.4..5......V..j&....A..I..Qx..Q..u...v.....4...k.B."=..}A....... \|^bU-._.4z..D.8......Q..wk....e....i..D.:COK..}'\|@...a!rr..I..=P....Y...A+k..........Y...5...%Dk.ch+X.._.\|rU..P.`....LU7(0=..A.:....{.8.kJ.;.~.p...]]....2....R.'..b.;6}7r....q......\|.../.9..k.u..!s....u....6.....v....o`.l.8........wJ:H.a`..hG./......?...}..#Q[.s..x.`. .(.M...B...:...^.z2.Oki....J.=r.....%....L1....m6.d....r...a.y..s.O......n...4..\|Uf......Q.k..9.,...4...J.n.j.......w.....sM.MCGNg....~....ZFM.K..U...}o....DF..Z.aI.`e.V}............0?.l.....>l.(....N...\|.O.{.H..7....}#Rr.A(vie.......o...y.,...xlG`...=...f.Xw.c..[8%.<..cF.aa7.....4....8:......6#.B.(..9^..g...S....).".....W....6.^.f....#......v..1;.ha,...>.5!1.7ruW0...._.>.N...$E..$..\|..+...'.)C>...KS...'..).!.k...'.....y.:..s...D. +CF.dz.,7vS.7....7.M-.....L.`....d<6.......,..H.u

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv19.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100400
Entropy (8bit):	7.998110943531547
Encrypted:	true
SSDEEP:	1536:BW62nhG8AQQBT53JFN+5TpbPZVBGhxZi1Ka1UxtunyibE/A7H+RyMtcNltuFTJ5N:oFyQQFJFA5TFAu9nyizaRbtcNl2uo
MD5:	D0EA1D0ABDB8F217D26A0CC27116268C
SHA1:	74F9A8FDCD8A5279C6458A37B75C38A09A4C921B
SHA-256:	DC51F45745036F0A6F9F902BDC57412B928DB386BF0393497DEDF53D183833E2
SHA-512:	6555BE4B95F5C175527209C7C570E72A84EADE8484ADD399A1BE63EB3E80963DFF5EB72DFFFA33FEFC1946AAD340DD0E45DC63F793BE5FCC1F51A1B5757CC819
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv19.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40466
Entropy (8bit):	7.995475681302088
Encrypted:	true
SSDEEP:	768:BW6Ng6eiZHToV4q3BzoK6hMB2gFuDkVk/xacKtpoLvzp5VTspL3hF/CnV7:BW6OvWToVT3BE1S0gQkgTKtp2v9n2B6
MD5:	F71B653B55720C08816297D442F005FF
SHA1:	EC97519842F03D1A7834565DFFE1A0A795FF03FE
SHA-256:	547CEE01D9AC02641550287145E9A8B33FAA10CF9D26EA53432924F0804EC4B0
SHA-512:	3CB0C4903C27F713FFFDE1B185895DF1DEA8EB7D1B34F87472F855B5AD6976333702CEA220793EDC7B25782BE872C5659AF5AB4974E1636BCD7D5BD734216DBB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98733
Entropy (8bit):	7.9984000423576855
Encrypted:	true
SSDEEP:	3072:oEHFcD+q5L9vgXaQc+DUY1yRibb3gw7+BJP:bFcKo9vgKf+DUYwRAjgw7+BR
MD5:	7AFF247D52FE6468A6E06E206616A83D
SHA1:	0965687E40619574263356EC26AB66DB93334A06
SHA-256:	67D33D3FF9384867E6175C75EF916F01EBF68DDD3C463371A537678866196690
SHA-512:	BCFE14A7C0C94CD30D62E3C8DED0A85E1AFF9062B0BD1CF9415E2673DC054B931FF7837387920C7F3CAF884721F967272534CC652BBAD41080C5517621F90CE2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	78854
Entropy (8bit):	7.997783115871903
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe5WQtNuTu7fM01vlPs1VQ5SKgK3xqxoYIMiALtG:oEHFcD+q5L9vgXWQCu7fBvmBKgK3xJ2E
MD5:	43CB62B23805F38DF000C7B9D0227402
SHA1:	00CFC3FB4D1292E824A76563E81078D2894B928B
SHA-256:	C5AD8B348F0C81F93FC6C5573FC6252E5D1F6FAC2A9810834B0222C41175CF0D
SHA-512:	8A04FA349BF29D2571915494DAD697DA2C55812A1A2BB4D38FEED36659E1809E5BC84F328CC857A12E15B3110327A3E264F236F7AA132345629F482307579F79
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	78869
Entropy (8bit):	7.997741561782965
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe5iSzOyXAOV23EiYqZSQWvBOgdXySw4SUGyyW1X:oEHFcD+q5L9vgXiuAArpqpWQgO4SUhy0
MD5:	306A37CCC16E48CD582D0AA8E2643C6B
SHA1:	1DA98DA8E420081FC1C66737F42C4DBFE679DE65
SHA-256:	875CEC1FC380D90F8E4F0405A35AD8B370F30B3C4FCEC33150CF31D7EE650EA6
SHA-512:	FFD0EFDB82DE109715A1965B511FA92D3755AEB79BC0400A9DE7E3B175DB554F699F63F53A2F6F1D50431B9C1782238F1FE3AB78F7F2285C71480521154A28E9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	62087
Entropy (8bit):	7.997256717321158
Encrypted:	true
SSDEEP:	1536:BW6L7jPEVdlmZuDSjp6r2mb79JEfwf6I0kZ0calY:o07jPqQeSjUrfJZ0calY
MD5:	068530597136C000D573D2CBF07DCA45
SHA1:	2D80345B8550146498393A3DC533EE8EF21D48B0
SHA-256:	D122CAB4C0DD68F062F3ECA1831521456916655D90AD728CF37E9BC2E18B0B1F
SHA-512:	314631DF622F5F104FA0325F7F4CA3246E9013489B12A15302A224F2D026077AC3C48C2B3E770EEB232841CAE01E92E1527DCBBBB89D1AD69A06885E869F58D9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.5.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	70895
Entropy (8bit):	7.9976539954309205
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe56b/H854Ys+9T1OM4FXNB+xwVvhzSmLhEPbOke:oEHFcD+q5L9vgXFKmT+zEK1zhEPC24
MD5:	62BD966FFC5049BF7EB18A93FCA491B0
SHA1:	3C4BB0234E229219E5F346A2007082F780BE1C0D
SHA-256:	14CA1F80674F606C54925B3B6862C7751BCD75B0C15C22002E954B0D33ED0F85
SHA-512:	CA1AE12DF982CBC242237A0BA50DD21A16A24281745DE9AEF0B2CE8E92179119CA38605FA26B2559C1055CA18E2577A073A2FCF9F5D5CE733778569EB91F9271
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv2.6.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31651
Entropy (8bit):	7.994928165465702
Encrypted:	true
SSDEEP:	768:BW6NuYrJzFZdFjqpB/yTzryiNGB7S44Gork1d+34PMO9GTgr:BW6gYrJroyvNiz4GoY1db9e6
MD5:	D5A0EC5D290F02C4D03068DD57ECF672
SHA1:	4243FB0146728E2D5566ED7D771156DCE1A2FCA3
SHA-256:	6DF1BC6AB82B91079D9372B28E30CBCFDCB0168A36480A47BE76C73F3F49FAF7
SHA-512:	9D383AB71F87FC155E57DB2BD23C6EAADE5EBA87E0684CA9DEF92F6CDA46F29E306FFDC597C84780A4CE48D82207AABE7C4584CE9A357E5D24F33BBAD44C7162
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv20.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	58143
Entropy (8bit):	7.996907279683717
Encrypted:	true
SSDEEP:	1536:BW68TO2X/i2z79oufxd9UELdfqShtnwjpMR7h34ZsG7c:orTOI/Tf9ouZde+/76pJD7c
MD5:	24B707FD8F1EA5BE94980DB03F9A4974
SHA1:	8A43A69E524AA1C3DFCDB9733B6F24FBF494A983
SHA-256:	D40D84E9BF8832D4E07C6F20B94E3C65779F5676250AB5CA2339B3DCBF0EC84D
SHA-512:	0811F17839C30C6E375D29A41D1B0F973A988F73D0E3433C70E96D71210E98EAED82AB0FFB9932F804F946F322F3EF05BB97B3A345BCB80648906F61C675ECEF
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv20.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36741
Entropy (8bit):	7.99573234379355
Encrypted:	true
SSDEEP:	768:BW6NdIsjO+mlsN5Eju86k+lC3KI1T2xshPQZpjmz6+psQtHml:BW68/lsNCjuT5MKI1K+BY06Oel
MD5:	C4A315EC291DE2F3F060B1EFF06F822C
SHA1:	0AC931648653F07C6853E0BA0DA03369AF79B228
SHA-256:	5514E5CDA485D604D5D175050276EB54BC537AC3EDBB7FA9BE6BDF14922F995A
SHA-512:	CEB7EB6FC34073C090C4DB6B3AAEAD2A52BCC8339903B7EA9458B65E63B77B002734E10270C2140DE9813C98CE7F7F7D5738BEAD2047D603934A5FBE130CCC1A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv21.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99457
Entropy (8bit):	7.998216605387722
Encrypted:	true
SSDEEP:	3072:oevBHKusW1xg1krVLPOuzHUg28+U9NdaXUHro:bBHKusMW1tujUrUXdaXUHE
MD5:	8BACDD58461F723850227630FEA68F61
SHA1:	33C75A0B8BD260F260090ABF8F25BF94A11ADA73
SHA-256:	79DF17693D9C2475D709983ABE3B900E751BD1E58964EE34BBE8EA916FA07CBB
SHA-512:	69D1D1E4563A8DE7E597249F5490517807A89CBA0E72AB07C70A75800A41CDF5B54923E0C0FAB27CCEBEA3B20999C09A0E0BEDD40218473E8C07D637EADEB5D8
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv21.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32168
Entropy (8bit):	7.994435253905921
Encrypted:	true
SSDEEP:	768:BW6NE6olB/BmXzITGVePTRquaTG1vjNFKaVtKJWs08:BW6+RmD8rrjKqtKJWsx
MD5:	6C692AE84BE3FE987C5FC52FD5AEB9B1
SHA1:	FA422785D76A48DA99F731A0DB17478D7D142824
SHA-256:	16CFB08F9CC69C1ACDCE702214720F818686CFA9A42F3FF05526694564FFB431
SHA-512:	8D9C011936519483B04D6D1336D9BEA2272633BD550BF0DDB6033D06635EBF19DBA581D9FA8455A41BFA5DFC53D0171BFF7B692EC3750C21EF50D4C1F50B5A7C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv22.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100759
Entropy (8bit):	7.998386882859617
Encrypted:	true
SSDEEP:	1536:BW60OQKK6Rq8xEwZUzfHcm2bcKctvSRPCA0a9YdoB01M6mIRY59SkT8WNSQfUmfT:oJ8RqLrOwFdG/aeB01yIRIjoWgkVb
MD5:	A93213451F57225C3051FDC3A9A54D33
SHA1:	26642DDC5DEFDA68EE2E9C9048718FD09300A004
SHA-256:	685DD381523288E76ABE931E340D79A9A79AC66A0CFD1B320AB4273B856401E1
SHA-512:	E44E074ABED6EB5263BFC43A0DF6A9CD1738AB6B1D1A9E47157A32CE951C6BF5153FA3F253C1A7900FECA1F398F4C78A93B3D143E9CA2A243C88B2F0F566F8CD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv22.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40041
Entropy (8bit):	7.995642545194862
Encrypted:	true
SSDEEP:	768:BW6NnnkxCV72G3/1QpBiVDe0q6v3NcQd8DHGIL2Zak50f8r7ix:BW6xqa/2B+ev6vS9SbakeL
MD5:	6B13FB595DF0775BD7DAB5C4EF1CF33F
SHA1:	87695667DEBEDEA6F532DE90211A139E43061DBB
SHA-256:	DF4BBEAF14D89508FCBFA0E5CC50513B07230AC9956F9B2EA0B03A815DDA6B3B
SHA-512:	1CF8B936012CE8B810109D0B346574BF7CE2B39554D2961DEB82B7AF0A4BCCACE3E88CFDFFAFFCDD75B2B58524B17CD8A9D865048ADA0A739F57EECDE61978E5
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv23.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	93286
Entropy (8bit):	7.998129703606323
Encrypted:	true
SSDEEP:	1536:BW6Yq0PMa088aar1sa5V7Ps9xFtpPd+FdTHxjEf6xWwOJM11yZlbLAn:orq0PM4ar1saL7sxFtFdUZxQf60wOJMj
MD5:	1102C549BF4ACBE4400788190D6FAFE7
SHA1:	1625A297A43DBAFFB10C3F608D79E964C86039F8
SHA-256:	DAA3E8880F7B5A880F77D81700A439A5A64F59FF3E6B879BAD5CAA497AE3262B
SHA-512:	25537A6AC18D883FDB6A55E8B4BF08EE21C3E31006F618EF1B5FAB3042CF3B5CD234FBFA0D99E20B6713A5A441CD033B4F7C28C874288BD256DE016C6B8335B2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv23.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32829
Entropy (8bit):	7.994035272067815
Encrypted:	true
SSDEEP:	768:BW6NBXvNQv2HVaVV93algtK1sOFSbFhSTEMKT:BW67VBVaD93algtK1nFXS
MD5:	5A706F42F9089D7AA5E568D189BD1BCF
SHA1:	F03514F3496ADA198C372E2322F832F3FA177473
SHA-256:	DCA0BF36CA8F7107FDB544AB5EC0B0DBE0368EE867AA49C5DA83EFF03A8E1502
SHA-512:	C6B1D36BF229980B605B4253C87A4AC1F36D40F857FF13E08978C764606696D2F05F99B5D5471DA71111B046611E796076C49B4510C4D69D904CB2BC652BB345
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv24.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	63980
Entropy (8bit):	7.997454343210385
Encrypted:	true
SSDEEP:	1536:BW6uQa7kqzEk9NIgRdJQxSdbRiLiW9RoLyCWjkL5YKG:oDQvqzEk9NIuRbRi2a8kGG
MD5:	1CA74733AE8ABBD526A623D582E90A86
SHA1:	260FEF5EF8B976E4F4AFC691A68F234042B4CD9A
SHA-256:	F717F00037738CA385C9AE1B3E037E0625E85FC98C8DE173DBF7AB7022890D2F
SHA-512:	B1AA1F49CD32BE6D3F7BBE786A58B784EC12F04A80723542A9C4BE8E46D7CCE3A71E5D680739B799786B2E29623CD81440697A2DFEBA9E84216B796342EF4AE3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv24.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	42326
Entropy (8bit):	7.9961938809961035
Encrypted:	true
SSDEEP:	768:BW6NLQQa7c7qzEkQF2N2HxkNfRdcni5QNFVw5yv5aB2YsjpSU2/y5JMTPQokRgmi:BW6uQa7kqzEk9NIgRdJQxwQv5sMjp4yw
MD5:	E9FC5502E223B097FA82863E38696042
SHA1:	E9080049C173BFE988B52BFB2B282FF0ADB31653
SHA-256:	3EFD7525C6E1C07381ADC32A22B66EF88C64FF2E435685017E2496E6DE679537
SHA-512:	E34A02590B00F8E0D0B752C8915AF3EA8C3977CF5D7649B13EB905E17CE1BCA8BC4A0B8BCF0D638C1A87574967CA911FE644321A2A5F930CF320240193EF235A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv25.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98017
Entropy (8bit):	7.9982280992744155
Encrypted:	true
SSDEEP:	1536:BW6bKwZty86+ddw8GtnmjXy5UXfrVwuhLnT7vsyH7019PlMmX8N6z0WNumZKnzrN:oivpbGBPCV3jT70yH7019dMK8N6zrug2
MD5:	521EA1C6299FE47C3B8F46983A5F5F98
SHA1:	0CB2134FDFF277C7E673C7AAC0776DF32B81315A
SHA-256:	96DE6B919F013279A734B5227AE3338C63E18EF48C9C5994F9BA4856A53C52EC
SHA-512:	B3247B01D56B42DE678617C6B034FB28D753BD11BE374161ACFC85A8D407C898D57DFE72CAB97CD1E0DFD6728732D71358B8B8E1F7F022F1507F75618EA0C157
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv25.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37706
Entropy (8bit):	7.995482814550673
Encrypted:	true
SSDEEP:	768:BW6N6Sm2VBZlYuqrq08AqILNc9asm3sAdnRlyPIHH/DMP:BW6Jm8HlYuqm0e2NTsosAdnJr6
MD5:	7BD0788C2A434C64645AB556C23A14BF
SHA1:	457BF437B71E509C067F9CA989F06507B36C7D41
SHA-256:	64074ED1669C55D065ACC85368F2BD1CEE2CC99A0DEF52DED9FEE6AF4B03E9A1
SHA-512:	535CABFB8E76FC86CE01E0C7AF284C49CC906C8C2C20FDCB567C8F198D913B41980C528E8C12B1AE18D76DB65E4353D76FBD7B260544539197D35CE7161631AD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv26.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53037
Entropy (8bit):	7.996873678733814
Encrypted:	true
SSDEEP:	768:BW6NA4KWz3oik5y3UcX52+LgquI5dv/Hxg+kzQqkq9qIrk/wXjmvkMcrbDGOh8c:BW6nKaoJy3352+p5dSHpqojmvNwZ8c
MD5:	7DC228BB1FB3CCFC2A310127002336EB
SHA1:	D8B6ECD339DC0286DEC5CD9EF5211849AF3B56AC
SHA-256:	4C3198AB4B08000E629C09B7C8CF396477C67136156FB0335D6BD09749D1AF0C
SHA-512:	711A83B7B03D07131D1500B8941A7DF06695186AA7871D461C01160EC55B7BDD5B9C80A9175B59CB1E89CBD2CDB59CFE8C45B45F1D12F3AA44AF7812F755F154
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv26.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31189
Entropy (8bit):	7.994281553790379
Encrypted:	true
SSDEEP:	768:BW6N6GF0a5kjHtVUFLBwiFwBsfmV6dV2e29OQoQnx:BW6FF95kj/UpfejQdV2e2YQ1nx
MD5:	45DBEEB0F96E14C59F803893BD7746E7
SHA1:	A02C2C8B1394E30B8D22B1A7941D510EF17CC7D3
SHA-256:	4D8E74DD8F673A15AE145743B068776EA448DB5C5BA3998AA52284EE7CA0E49E
SHA-512:	7D6B2CB69F7B8177410D415DA23F9187DC8BA9E4710847A77799249221A7E61A30F1A07E5971B6D6FE1506DC7CB8A2E46D4FAC338905A3F129A7D2514F9DF67C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv27.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98416
Entropy (8bit):	7.99821113686373
Encrypted:	true
SSDEEP:	1536:BW6r3JOrGfAQmGi8dFZNWZhY20Qn88JROOmjjGuiXbRq2+FEHNSijyUi3Jh5dQZj:ok3JpcOWZjHXkuuMRq2+Ojy93sx
MD5:	C0D13EA141E94E3B4C3B46379BC86F2D
SHA1:	D2F48AE05CBB726F2428E4ED7B3524954745932B
SHA-256:	AB6FD893CFA08AD52384D6EE973A065BFEF0A9031B166B776CFEA50E82BEF86E
SHA-512:	DD1F2E8A6277DE2358CAA109504C696576A70E01A04E447D7FD720CD19D83EAF6B39D1DA0F1542697AF7D0AC9046A3D09E1E00BA0A33F4C85F1EFF230421C1CC
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv27.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32641
Entropy (8bit):	7.994716793370817
Encrypted:	true
SSDEEP:	768:BW6NCOggLFFiSgWEJEFkM84MP6zbHqIdrlPtBskaz0Qo8ME:BW6TKAxOGOIhllBsXGk
MD5:	E88B3293685B5BD4921F00B41181F2B0
SHA1:	465E6B6356B6DEBE9AEFD74AF6EF2E482D1A7459
SHA-256:	C215E0660D9D639C4815C9E21033CAE69A2B3640F713FBD131983E049AC12B0D
SHA-512:	F3ACAA0D303CC7F16FF83DA358AC905E6E8545D59097216CB9C9749F4BF6D3C6BD10731EA381CF2EA48A280EA48CB387629E19248C1E4927CAFD33799B5BC1EA
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv28.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	107963
Entropy (8bit):	7.998383266675414
Encrypted:	true
SSDEEP:	3072:orlF3F4IMAjjWsL6V2RpsNDJ33lblD7a+dDZWQVxztybt:glb4IMAfb6V+EDJFbN7jrx2t
MD5:	2C0C638204B7B944014072E9BD661C2E
SHA1:	0DB79474902F51D17F4B759ECC9B8832D010C95E
SHA-256:	152C8CEBCE73C59ADFF0CB6AF008E4FACF0645F48A23BB39284A322789515C4C
SHA-512:	5FED045ACC6798F22303475600F0A8A14232EE1A1B16A6A08A1AE02BCB1B51A1EE98F49563196289C90F6CE08F18453473BA974A7B5E0DB67B676447E4F4706A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv28.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40990
Entropy (8bit):	7.995348789067283
Encrypted:	true
SSDEEP:	768:BW6NYJjINNX/HWigAIDxhD18g20LVLDFyvWLeRkJxa7WdqNFnKbYl45ZHQ9:BW6QjIvX/j+DxhDL0vWqR4uWtEl4LHg
MD5:	543591DCBA79B507C11B753FDD53D763
SHA1:	2857BC187AE459798602C1934DD5CB8D0AD1A38C
SHA-256:	836B6F24C024DB7707C7305AA84A15B2225E6ADB4470D26B3112FA8FA87197A0
SHA-512:	45597AD2995C6279145EABC6720AA36ED5288FDA7C09DFAE160EDADDF6EF40A895415E9E9515469A228CEB12DF5E01614C078D57A10D47E62FAA4D8685FCDB19
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv29.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	96113
Entropy (8bit):	7.998130790714943
Encrypted:	true
SSDEEP:	1536:BW6HF9pfWVCSg8i3ClEmOZ5B5rDTIxJl0vyJcTdsOfX9pwnk3OLrh5:o8F9p8CSghSlfsB5XTkJFir/L8k3O3
MD5:	7C68CFB5F5AF152F8D9C45C83968F9E5
SHA1:	CF14E3B400F43071E3611D692E50B43B5E7FB0BA
SHA-256:	68A83A6DEFE3F339E116965863EF4C536D61503DD87F6ACB3C1ECB18B716821B
SHA-512:	CE30831FC5C2280BE067D6F1C51CC739B9E1CC152C8296E439C055E817C408C8CABB621A6B0E1D86858C9214E6929C5EF39A910663FABEC5199B81297A9587C9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv29.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35504
Entropy (8bit):	7.995373807133793
Encrypted:	true
SSDEEP:	768:BW6Nb1X9c/jyps46MdwPtxJBAwLGDIJIvQiDHqyAYL7sH5f7duO38Tbz02PZ:BW6F1Nc/jyCfMdCxJTLG8IvQ4HH9If5Q
MD5:	737A1374A5503F702CD7BEFFB402D3D2
SHA1:	1A780B0A10595593080718EE112922ADFD48F6D9
SHA-256:	9B18FDD03F15144E86DF6AE41BF04793AC713BCE12155D2AE55274CAC80093CA
SHA-512:	E47A9153566D17BC20E6E69DEB7702AECC8D6BDE75674616AB00F64B43F363E8ADDA42B09B663E398FAED5CF6920D18F5BDF9D757A5F438C39C6CC87D353E215
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv3.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103242
Entropy (8bit):	7.998070019674833
Encrypted:	true
SSDEEP:	3072:obI5molIWlq0BxiLaYx78MBN90hU7gPqarJL7A:/soKWlHB3sgMl0hU7qqarJA
MD5:	C0300FC156DB04F541F7ED73F9FDBF8D
SHA1:	5F832818E0F6B3FB867132B3029DF65846D2DA7B
SHA-256:	363F0AC6CBCA8A470E1974AB22630E5CEA1862260136681E890D9DB5FAF8F6CD
SHA-512:	08F3E05C60680BFA8E2F9A01C10DDB1BC8A811022FA30E8E4F85288C630384737DF2A50F431725142D7E6C3CEB379CB8098E0C7E53BDB510A2C2F01A229284C3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv3.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	51985
Entropy (8bit):	7.996722146000946
Encrypted:	true
SSDEEP:	1536:BW6JL+upCfhsjQCT+k8aXj5wnH4P4Yb2PNr9PDKNSc5A:oG+xfhfC6EtAZYb8NFDjcO
MD5:	6F3F2AB7AFE7A02426C29B531A1E2059
SHA1:	4DC70B7C61290ACDA9018EB6CC232B5FF1489B90
SHA-256:	BAE2F04E13BF7FC6E3E17C37B5DB13A227A9F4FA715E1B4A854A836FF549DDE2
SHA-512:	D4D1FBE47907FAE1A9E8B574D8024BCF447BDD40AD31C59044A9DB1E76A66694674FF8CC2941610F70A2ED8B856CBC8F2C58F287F6EEB7204DF6212F3D3305E3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv3.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35504
Entropy (8bit):	7.9954059317529005
Encrypted:	true
SSDEEP:	768:BW6NQoNJKDsIp65+iKvPZhaUnSgIt+Gng9DuwX1cpsrh3RqfXacIS:BW6+oXTHeTaUnSFDn09X1CuRqfXau
MD5:	BCC3E81F72C645434C9481A2116C60C0
SHA1:	292C7B2855A68CD0D73A1463E2BB813D35545828
SHA-256:	D9F8F7214FBAB1A34E05A598294A8334D349805E6769055BE2156A9DD0B6DABC
SHA-512:	E7C33B0A9A1241831B16AE67852077F3B33B7981606BE961D8468426F6B74C3CB0350E714DA3FD9648F17F679049E6E55AD7C50D28AD1B466E3395B914E660A0
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv30.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	105116
Entropy (8bit):	7.998285268709793
Encrypted:	true
SSDEEP:	1536:BW6xUV3Pu+H8iG2VSSR46tZRW4paQXjxOSbIdzsEJ2D+BE9SlIUry3Hrs2lf0UJY:oYUVJG2nDTIIaD2kzrE+BDn+Xrs2HBK
MD5:	FCFC417613F8478F23B9C140BB23F4A7
SHA1:	E7E01B23F7676D2C0800010306E7361532B9B71A
SHA-256:	C97DEC1EC391C52D9A46BBB89E5930E9AE550D7052C143C5FB682ED713DE2211
SHA-512:	EDE0D546287D8EAAF4BC12A094F568B3B9DBDE21C29729A387F6DBE482EDF013A7C9757DAD7B71B392A0BF3342C0DFD134AF01F36D9B02DBAB292A05FACB7EAB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv30.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37229
Entropy (8bit):	7.994543928422013
Encrypted:	true
SSDEEP:	768:BW6NJKtpB5oVnsUMBcDf3fRZV6ioyxr1nThx+B0LZssfebqc:BW6Xs5EsFcjV6Ny/hDLZssBc
MD5:	6C2BC1DA0BBABB0DF6F041BA937A20B5
SHA1:	CF937FE32F3547B7DC36BB5CAA1A6935F6EBF96D
SHA-256:	123F6347C23DB951962166C5FAC65FA4807E2A1167143608A9701E8485CD903E
SHA-512:	E1A805EC88FCD9AC15F420E3A766A9ED41D57D8BFD104C9D4326D3C4EF91D56B5985A7971FAA36879C5315F1060E301609D2E217FF6AEEF1CF27E5EC51D08D12
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv31.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100022
Entropy (8bit):	7.9981863880802235
Encrypted:	true
SSDEEP:	3072:okH6QTNR1VHEgWRq521huDxmFscVDWzsO:WKrNW71WTcVDA5
MD5:	6E48EF4B588D5002062771F83B511CA0
SHA1:	F62D62F9EA643704E4265A5765157743FCE5B794
SHA-256:	CADB718A410A980F1AF13CA8A1036CB2F39D7D4FC9950C87835C4EA52096AB0B
SHA-512:	DEAED369CC05F5B4AE8890D9900F1A5F20501EF53B3938C32E9EACEA943C7F30AD544642D07BAE679B8E842595EB4C2F20ECE442075A77024CFCAF00740CF117
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv31.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31714
Entropy (8bit):	7.993413464931367
Encrypted:	true
SSDEEP:	768:BW6NmHGlxxDckhL+OHikgd6UsbsZf9VD4+1BvnZYr4zN:BW6oGlgCL+msPZfo+bZYra
MD5:	49B41606048FB6579B5C827AD76BEFA0
SHA1:	3F7576EEB4DF5F05CEEF96F4987B94D3BB539A5D
SHA-256:	973FA4E3E481F20E7EC967C2E187BBC36190855B23863395672AB3BA273E2619
SHA-512:	96206542B22540982A0A9B485140541B9A5368CEC77FBA126C5BDF8FBA223015C44157E1A77E15D936C4B86E94CC9017D1A58682F73EDBFB5C438FB496416321
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv32.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100086
Entropy (8bit):	7.9982240430769815
Encrypted:	true
SSDEEP:	3072:onIwmSjknvnvYoANpvMQ1gM9zvMsPxZxBV56r:mmSjqnH0v/gM1M07V56r
MD5:	ED55D55ACBF2BC589FF4137F91BA917B
SHA1:	1DD3FF5BB16B506456E25715D3DC3AA46DDB1794
SHA-256:	B45B6C087B04A99B7E0B08ACA4D8A3669E195670F9EBE3B8296EAF06D54EBCB4
SHA-512:	5FED35382747A4C24766338C8E976C656F407DBC24BFBFE8AD18780598E64AA1D2793C21282ECA0535A14DF2F993C4090D54789B018C0449E1E7BC5373B2F935
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv32.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32338
Entropy (8bit):	7.994565423368479
Encrypted:	true
SSDEEP:	768:BW6Nz95veaYU+eg/V6ohlSRbwqxXofCVY4akXEr1hCpF19ed:BW6XpeG7uY8qxXsAXdpUd
MD5:	DC6D00260945F7978A7BBB54898ABDE8
SHA1:	27626BCB0CD95894877A0F8EAC9F4849AD9A0C08
SHA-256:	5973EA970E87174BE790CF7920EF106E8826927C68A3932176EC83D9FC845BE2
SHA-512:	344AD352CA33C033AA50E14C6266DA2BED5C2DCD3E021B0C443C0309480D8AD976584C0A6645B37DAD5A32FADB978638D80ECEFA2ABDFDDCDC4CBE820175810B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv33.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	88680
Entropy (8bit):	7.99747844792325
Encrypted:	true
SSDEEP:	1536:BW6NdgzKOR1dmPa5YfUp0xHauMB8oBGf5XN9jlPOJcIzEuHBw1v2yQgBIN:o46KOndmPa5Af5FM+oGNT25zEI0BQTN
MD5:	7DD26494230197E3554FBE5CEFB303FF
SHA1:	615E61F246115B019438B2AEE6E0F4199768F374
SHA-256:	ECCBB604596DFD593B795BEC0C04CB985C701A01EE50D21AA58367D25E3993AE
SHA-512:	1282E8BC55AEDEC378AA9BF3B5FBB147DDE9F5DDD2A445E0201FAF849FCD8392F07207DE626DA378E38986C400ED1F1980FCDD508FEB40348F1B410B5509C6F9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv33.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	44819
Entropy (8bit):	7.9960755318335
Encrypted:	true
SSDEEP:	768:BW6NuezPOzo1eMVaDwVlvDA8kgKrfMsB006pWPxGOaFB6iiZ+2rqCGyVSS38C500:BW6oe0oYMVacnA8kFrfTB006+8xF4dr3
MD5:	75D904723AA149166E0FDB850E933171
SHA1:	BC39EC23774AA7D964566CBAF35C23F6752E2FEE
SHA-256:	A9D5D5873CA1713C2C7C172109E127ED943014EEF0CAED269CA3354FDB373416
SHA-512:	C875E536B120798DA9C5BDAD351F2F21BEB35A3D6EB70BDFB6F38D9700333920035944282D21C4AB45ABA6C4356721FB01670D2D7A120D104C2A1D39782C2149
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv34.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99037
Entropy (8bit):	7.997888245921803
Encrypted:	true
SSDEEP:	1536:BW69IScAcb+rCsJoAQvm7LLsIw3o1QAyd5mp9aVWzABY/rkdeUmVgjpjpau/KGrd:oi3W+rCi2csFKm/VtBYAd70u/9wJF52
MD5:	9DDC5E19AFDF801947E63E9F1A4CB172
SHA1:	20A2A279E7E619FBB293500559F5485FCCD8101B
SHA-256:	3209106CEAC1D911D2B5BEF0EF2441E9285AB933701BE9E4B9749C773B83FDAA
SHA-512:	8D07AF43F5AC27ED332C8AA8B1F6D9AF92E4025D233124E77C1B433C5AEC8958AD31A4B618B066DE6AB62165134315EF949C6A2BB10BE31CA797ECBA528C5DAB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv34.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	38199
Entropy (8bit):	7.994828083625625
Encrypted:	true
SSDEEP:	768:BW6NMP+zF9wefol+psQuQa3h+IVbL3Z+qOMy5EKxAR:BW6lFykna+SXZ+qOMtKWR
MD5:	BA63FE08745649EF7409FB4B46CCC9A4
SHA1:	41183AF44A3F948952D72E609934D58F6AE7C77F
SHA-256:	BAE33927C53C629FBAECB3A6578C128FEB37A9F49FBB6AC8BDF8CC6386BE6FA0
SHA-512:	9D9E4AD92A96D3160F8392231021316659B791031E78BAD7A87E7722FAA50A8A704322B1D2C1E716B975C2FE45E904CA7B6BEA249C67E9E5F7984E079FC51579
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv35.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99251
Entropy (8bit):	7.998066777711538
Encrypted:	true
SSDEEP:	3072:oDEhVsfQNllK8auRX075JV1vu4fO7HmER5:GEhVxjAwK5J3uiO7Hl5
MD5:	C9AC9354B7E5BF16E8A02D8912BE5B25
SHA1:	830CAE5E71F17FBA34DE2EB0A78EDAF21B09741B
SHA-256:	7BFC65C85AE5FBBDD681F92A3901A17BA9D7E5F55B705967812E53D2855C4244
SHA-512:	C5C96F652EDE2946B24C74DF6548DE72D29796BA3A66DF06138B898EEAEE1B5ECCF6CF84D31184792B7664F9BEB3021E357F5802906A0964AACE19E76F0AE5DD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv35.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33097
Entropy (8bit):	7.994609982490262
Encrypted:	true
SSDEEP:	768:BW6NOh3fCcFSodnPvIsFLBhTWFVrXRRDtlBwyHyWqQ:BW6EhvCgtdHBPEVXjHyWqQ
MD5:	B885A0966AF37D3A1C28EB16B505A751
SHA1:	B51E6526C987935FBDE80CE039FDDC3E0460AB2A
SHA-256:	6A9A038A54D95860E3011F93391DBEC99FCCED9ED7A1A6615F5F8A1FE50A3157
SHA-512:	68F2896F74D6DCF3DE4A6BC13B9F378E2428B26907AF14D5B99CE335F52835B01B97A56160A81D8725D0F023057D1F5E4CE0BD8DF0816E0F38D2510B09687B8E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv36.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	102051
Entropy (8bit):	7.998156418187762
Encrypted:	true
SSDEEP:	3072:ogGkjn/WTIWJEKAYvZfd9DSPToJuewpv9e:ECKIWJLBbSLswpvM
MD5:	95A6D0ED38A760F66FB112A5DE59A007
SHA1:	B8ED6F61A7C517CD823F6D5CE0E9217967BEF890
SHA-256:	1917C0F40A87CAD58D49123CE2C7626943504C0F1B3FB8A4826958DE2FD9CBEF
SHA-512:	C0741E8EFA86F4432817CE679CBBD7A74EE7D67891E5FE23826A8AF8E114C911854480E9762FD937D0E4DEBD4CF82E33B2F19A7DCCC0F9128B6A9DEF8AAC4D6C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv36.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34219
Entropy (8bit):	7.995028541539741
Encrypted:	true
SSDEEP:	768:BW6Na79PrmgozVd79x9H4l22VjNHVda4G:BW6W9Dfohd79kl22n1PG
MD5:	946B26FFB476A97FE2151D1EBC46CB15
SHA1:	7C9E829F00161D1C314FFD35AD56C87788102DA2
SHA-256:	9593E3D3D284E900189B6F8E5E473B0CC83C817D7E58C649E10AE9672B005E36
SHA-512:	D0F5FAA8FB7AC11B6C0C5F5599D991B8073DE7B314D48903C3536EDFCB0B73C4241A121A8F47DF6C67F23EBF63918418AEF945F5C17F99231B82B5026C60F43C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv37.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	102368
Entropy (8bit):	7.998287814737377
Encrypted:	true
SSDEEP:	1536:BW697ZjN7E9eeTnfPLqxi1p7/p0A50FjiSyvNeLweTOv8rWEFhCtRthTkJ:o27NNQkQHLqg1N+rFt5OEaEFSTY
MD5:	27F06D436A9F1D9CFE5331BB820C5886
SHA1:	E1E7C6A9DB93EB16537CA3E55FBFF36AA03F6837
SHA-256:	871C8926B79A0BAE43A035E00C030AE79713A6B2B15116D25A9D0DD967D433FB
SHA-512:	7CE1F14E46ABD85210DF7E3AD957542532AD22A77E3B5D111EDE0C6B8912A94A0845E52E37BA2206B4816054AE824DCFE9438E212CFBB37B4C1955EA5B7DC72D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv37.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	7.99390210191762
Encrypted:	true
SSDEEP:	768:BW6N+314uNtmdalgFjuCUoMZ5Lp2idgAAuY5moUl6fKL:BW6sWuNplg1uHjXHAuYkl6fKL
MD5:	59277C66CA0C3F137749B2F0CB6E5C10
SHA1:	7EBA4A7CC9AFCCF75DE58D365749295A8969CD42
SHA-256:	5F98CE2635A33388E7E3D7793873D6304AD31BBB7D33362999D418E1297515AE
SHA-512:	F127BFF4423F9D072D29E35D2C3CB0587D777ACEC9DB16ED1B762D4B972755DD7D9FBC737F6D0A9369EC033F76DE3F4B9C5D23890C98D102CC86F6D4DC3C739A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv38.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100625
Entropy (8bit):	7.998258836304681
Encrypted:	true
SSDEEP:	3072:ojxobAh8Z/SFNO6swJ21ekvIhdmeDRjqcTb5NB:yCTZ/4NO8Q1e+Ih7xqcPl
MD5:	C607F49179483B4A4FC6D510E225E5A7
SHA1:	424BF0A62051C28C3E3872E5F78320E2F66E8F29
SHA-256:	E00BCDDC005391C50994D8C32487BD8218CAAF3D1D05CC6925BF810A240EC852
SHA-512:	6A6A907DFC581C92B205781CAA9D7788506BCF66103A790159546D06E00E9EE3DC3512E8F8D6370577D781AB7C13A106896EB39238D302CE3830E47A43A39C6C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv38.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33039
Entropy (8bit):	7.994125857127421
Encrypted:	true
SSDEEP:	768:BW6NDBqY1ZYCXu5bgCU/IIynDlmDPOxeUXjWx:BW6p1Z7u5bJsIXokjWx
MD5:	341724703E215BD6C8B1CC913B43C760
SHA1:	A348E7BEC48CC02A89C81B96ADDB5F72547BAD1C
SHA-256:	21F9220D1393695A01ED52B0BA713832AB84686ED71AEEFA5576ACB04FE961E4
SHA-512:	BD6A8E7AC01FDF7B3EE41E624AD5F5569ABC41B77EB83381A8E4082C222BB5F5433F60A8CB33898DE3E029BBB6812610369D9C118AB0CE1C012DCF97D31A8737
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv39.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98042
Entropy (8bit):	7.998232771168422
Encrypted:	true
SSDEEP:	1536:BW6XQPIX4GVmnGevnpNxj/tvYWvOfaYTm0ZjWZVwkss/k3/9Okm+DJqziTGt4jzH:oNUVmnGev9tvYW1pUWXwkxyN96mRlNzp
MD5:	5FF15A57BC129B5997E1ED33B59FD859
SHA1:	D9748C94D6986C5914C7ABAF7F941234ACFE3657
SHA-256:	EA50E8F3C7A99AE4A918A9E123F598056877022BBD2A9952538FC11D917C7D9B
SHA-512:	6D124768092CC59ABE911C60A1E17CAF7876C0B449318A912EB892CAD1E3A267E33B03C812D135F56D514D041DC7D3E0780DE5FB46285C386518B057901B64DE
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv39.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30982
Entropy (8bit):	7.9936602257846285
Encrypted:	true
SSDEEP:	768:BW6Nw89x7jFGYusgi9XnetODMhBs1PWsGef2/1X1PCr5n:BW6F9x3TuGk01PWsGpl1PCr5n
MD5:	06A392C6ED644F5EB544528F0F943CAF
SHA1:	F355C8E5D3FC6A45E451EA716F576DA2DF8C585C
SHA-256:	C6979DD2F845F6CBED19FD786A169D1B7E0F2B769912A0E7F31076870559C499
SHA-512:	5B205F29E9ED454018621B3D95031B7A27B3D807A4556F4561BA2A8A6268505FD3280EF109DB44CF4005D3C2DD1DC64393540975451DC45944C3230F459B635E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv4.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100840
Entropy (8bit):	7.998100994292755
Encrypted:	true
SSDEEP:	1536:BW6O+IYxyqQ9b0WMBCWjOsRFv8NCbY6aGtgVxkpLDZBDYbSm9gFnq+Tahj6rru:oAgMsWjD5FbYRLkpfnDY2VqRhj1
MD5:	69233711359E955EF620804A89773A01
SHA1:	31BDFA90CAF80D82C6ED0AD96F5AEC3E76894438
SHA-256:	4F2D662F51F476511B875EEA8D545B3B398D5D636955565EA7582A5170AE5942
SHA-512:	D625A81C8B2CA91366276BDB60CF9EFB291AFCF10105BB1950605E0BE284E2A09CBDE283CE5CFF1C5D889BCD2B0C8E20CA1A9D205E9B11D0762C38F5CF0C339C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv4.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33061
Entropy (8bit):	7.994303843711856
Encrypted:	true
SSDEEP:	768:BW6NC4JFpvJfPSG1OCkkF749AgxhDGLKVUNqr6W:BW6XjTfF1AkF7cDGL126W
MD5:	85FA11E8E404ACB68CC0E94112DE4EAC
SHA1:	9726564F9B236EFE6A97647AAE5CD33D221780A7
SHA-256:	4B889FDB958AF334996955C1D16CD0E8C2D8CA32B0D7E6C1D48CB7F88C74E503
SHA-512:	0F3B1B2BBD8E6CD60F1B6923192AC3AB5BEEE5FE044827D929BBF0A32AE3AE46160A73EE572878AF84178096C947D3D779DCE7ED92DF2DD0A1F490B68FF7807B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv40.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	101881
Entropy (8bit):	7.99851186478424
Encrypted:	true
SSDEEP:	1536:BW694jBnxeUrwTeoxi51T2o/IgODbDnexQOH1mehLxun3wbfwRFsWW1BL/tzyoL2:oD8ThZ6IgUbqxQODxu3wb3/zzErP
MD5:	5650BB8A3AFB95778C068056EA82F1AF
SHA1:	3862B30011875537FD471AD3EEC60436E151B8F4
SHA-256:	3D6BCABE68EE6DD6CF5B1CB75674C71A4AD44EA1DF2EEF5B9247E6832367F104
SHA-512:	EAC304C3775604D0369336750F343CA2292F348FA9FDBEC3D80610D609DE0795668A9235223F70FCD46E8D6BC59CB8C0EB5762ECE3AFC08F7B867B0686AF28F1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv40.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36152
Entropy (8bit):	7.994665199756768
Encrypted:	true
SSDEEP:	768:BW6NyS+X3jDMzxYUUo1o6ySohxIl1RUY91xOpcSsUPrJmMWLjlQmmwB:BW6MJXvOxY/o1h7ohGlTUdpfserk9hQs
MD5:	136E5B4E8CC6E1A10CD31A82271FD432
SHA1:	CC75803F4A294AA7E5043C924C5564E11BDB01A1
SHA-256:	541A4CB4AC89DC976197A2A355237633E615DEE30A717C1F822FB0387BB998F0
SHA-512:	CED73B5453D8A73FB9EA953659A3D6D57F39843354D3E18388D2D6926B3917082F98C8573B32C58D1F6040B0E9E6BB791F7A5C21C0BE85D6CD579F51205F8461
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv41.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	106388
Entropy (8bit):	7.998355984294275
Encrypted:	true
SSDEEP:	3072:oeXeOmEBIb9CWErJZcZGYL3DRg6egHEBKC/K1:Gu49CWE9OZG0SNgk/0
MD5:	EE38E0CD908F86BB34C79806EF14B1EB
SHA1:	09AE883AC80691697BA410143814877F174C5DCF
SHA-256:	2F062581D9EC9D7ABFE8661AC22B933AFC54BE7389C61C5DF0DD96046BF83497
SHA-512:	8A854C366554381F645FBC75EC7E7D7D2E647F949738B1C8B67C3DC05BDCBED46E26AB9D76F30F56DBCDAA523C090338A10E6DCEBA9158B5F281885C5FF1DA4B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv41.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	39585
Entropy (8bit):	7.9960939395156245
Encrypted:	true
SSDEEP:	768:BW6NFGFd4QWyWse5zIJX/0Na7USo10TT4Od6lGD9raH5L1sPklLfoN+C:BW6SFdlIzMP0NfSsGTrd60prm5L1L2Nh
MD5:	C2E464DDD469ED66377B1D87DAF374E9
SHA1:	872D185AC8B901066A18363671F5CF82577D343D
SHA-256:	B8B6885914A26B0783B641F8FBCAAF2B9AB77DA95052ADCA3D72AC8A2D85275A
SHA-512:	C95D062EB5A071342911C5A9DC504054FD449AD1DF0E12A7407A88829D2A8CC66D552536E3185A4627B1A6BDD2F3ED9718653C67874791E27D9DDD5A8EA7F6C9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv42.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100537
Entropy (8bit):	7.9980900812264775
Encrypted:	true
SSDEEP:	1536:BW6jkgvEOKgj31aCxB7AgOUNEBaBAFdl52UD9uVwwIZpxtYeoyMIvWZLdy:oW3tKgtxBM8jAFdO+9uVwwIptYoM7Hy
MD5:	F073FEC496AC5960CD531E513B582CC9
SHA1:	452E711982ED3EEFC4DAC87D35168FB71BAE072B
SHA-256:	C0177D09026E291B5D9AB07270EB11AF84E803035EF40AB3E049C5A6222B608A
SHA-512:	F817FDCA3208C4C0773F4AA85607B0CA8EC17DDEA8669CDE8DB791A156E2D8FA0E2948B7CDF9AB50D2CCCB0013C59B4EA289A284199F084B95F5F361C33A9FC6
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv42.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33474
Entropy (8bit):	7.993793390704863
Encrypted:	true
SSDEEP:	768:BW6NulOXTDacv8T8j9H89dag3n6/xbqYWtdtOBvSt2UHQ+NZAk:BW66OXHLU8jV89LUPWBt2UHbNZj
MD5:	CC1DF6047E4681437B87702D383BBD98
SHA1:	D92EE9749E6A0ADCA26B5BE52995528159BD153F
SHA-256:	21F765962B28615E8AC9FA0E54D71B14E85A44726B2EF67D8A2C8B0B1D800A34
SHA-512:	F40F9D13125CB716A92172DF40DDAC2D0296C80701B25115E79E07E1F9157343ECBB981264D63CDA2C53555F661F4EF4350250D9768760F05339D1D48E2AB42D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv43.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	94068
Entropy (8bit):	7.997730230347179
Encrypted:	true
SSDEEP:	1536:BW6avOkNbLnegxT6Qa8DWEFkBFRHZPAkvWCeIqmoFM2wVLKcThJ:o+k4gcGioe5Pzv1eIqm21QLKcFJ
MD5:	52DBFE44F46C542099A53306A1E20721
SHA1:	6AD3B8DE484520F4B35AFAEF79380BA16038EDC2
SHA-256:	E828D0D534098273B0F77F37A95A07F1451D0F594902F34768337AD2C381EB17
SHA-512:	88E1ACB045F826CC7D94197D52CEF676A6B52AAB8CC4FF814867C329D8FB0158DCF0C855B1ADAC4E9E44C7A62D27431B94A1E6BC58086C0144F7C1816C6BD71B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv43.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	27801
Entropy (8bit):	7.993413795984102
Encrypted:	true
SSDEEP:	768:BW6Nw/Q/zvpl32Cp/vaiQLt4YCfocDu0jlVCNMQm2KUPQOknsx:BW6uyzvpl3BJQR+focTlcNXmh5OCI
MD5:	87AF00A1137B5F8D1E68C3BF739A5BC1
SHA1:	0B46C8C6819134DEC64A985278517738F89856AE
SHA-256:	86D5C6999F042D4ED076DB76B6F24FD94B462A88AB146922CAD236DFC6DD1C8B
SHA-512:	9397360C7A294CC9DB1D84266F90F6E81E42FBAF93B1531203385637DF53DC9696CE7EA024D690C5D09D025C964210EBE91D8CDFD70C34A87944E5B6DC3D3044
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv44.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99074
Entropy (8bit):	7.998093404053396
Encrypted:	true
SSDEEP:	3072:ouvF/yBobA2DKdpveu2SzyIH7FU7yNAZC:oWbApdpmY9WXZC
MD5:	AA3B049417B78B1453B7F83A8840704D
SHA1:	D51ED06C114F7C6DDF4EB95BEC14BF84631DBE41
SHA-256:	5DE3E13B34DD3AAF6B4732C189D9AA396EA672A53B6D39638D7B13BFB25A11FD
SHA-512:	4ECA3C30079B880DD4A41E28836E14EDD316AF69F8DBBF3680702933F57B461B2164C1DC11395D28F81B56507BCA49A2119D8A61DA18966CD685E36E489951EF
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv44.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31845
Entropy (8bit):	7.994830977471325
Encrypted:	true
SSDEEP:	768:BW6NXTsdEv2rxnAUAJYb/Kqj8JZjbZsLbBn:BW6ds/rKUUSCqjmZjbeLN
MD5:	AE721CD59DF67789B72FE5FEBC3903F3
SHA1:	A1AC6F678715E98E6DC412E3B06BF9556181B4D3
SHA-256:	929295B2FDDF474A277B72791FDAE5F9E606C37C6EA553B45ADDF0558A0F89F7
SHA-512:	EBFA7BDE6E57B6FB5BF114E92E2CCB71963D8B5520F386350F2C576B0A5F6A70F7CE477341852BD79140A0BD07969DF91FC02834FD837A64DD08510F4F1752A1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv45.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53792
Entropy (8bit):	7.996398865809003
Encrypted:	true
SSDEEP:	1536:BW63wQHGB+Ee6ignaq2v0MZe+/OjwqHhWDNuy:oOwQHw7e6ba/HBWjxQhn
MD5:	E5BE9FE9FC69D4CA4FAE3E164BEEF8F7
SHA1:	4240C824C6D42D0E2804BEFE78B12FF6DD441E31
SHA-256:	B8058CB5EB9C0B765F5A278B8CBF144536150FACF37BD79E4837BA2AD0DEA629
SHA-512:	6F01667CEF0BD072A72B07217B21E5BF6A14AFD3212A17BB106F69F3F479D3788CF928A0A87A71975945B78D9C8B6A2D423B31DC1EDC28B68AABC62F4562F713
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv45.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31813
Entropy (8bit):	7.994070863700724
Encrypted:	true
SSDEEP:	768:BW6NC8gc37E+Q7Ia3g5fzgXwcMrcgFcKeMLlwWExwP/BC:BW6jzrQEaQ5f8grI3KeQlwWuwP/Q
MD5:	48CA22EB8386290DFD54E8C474879B52
SHA1:	311CE04FD8D3C5ACD3BFA13BB3024116F653249C
SHA-256:	3C52B3127BDCF7C2AF11243F0A51DD46FC4A8BF458C8C6FA109EA3F92A60534C
SHA-512:	7EB4E12727F50E75410F9986238B69274C2091E30BFC49459738D93B3CC19E54432C934E121A4656DB114D021BC8DF3A3E388D5755A3D0D583FBF77081E49F7A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv45.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103785
Entropy (8bit):	7.998154804983971
Encrypted:	true
SSDEEP:	1536:Z3LmKk9efPMQ8014sMlerA6hmOGcpx9/jz8Uf3OxCOurgcrPZ5lBWz1ZWEb5:Z3bFMQ8eMSx9vVuCNkMzBG7Wy5
MD5:	FDCDBBBAEE3059F45AFE1563E6CBBFA1
SHA1:	070C618BD94A68CBBEF90A7881613374B10188D0
SHA-256:	14B18605E1084E969EB0FD796C07FD885ADA907947291AF17997DC91513E4DD5
SHA-512:	97DD90D5317B04B825BA3D47F2083155441DE41F23B077D64DD98871C55EDF01C9BCA64F593DC1CB54B7A956551C76E6BF35A0167BE061B9E5B0781BFF22BC84
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7.....".L.:.M4r.v.t..b..tO..~.....&.G.....;.....,}..E<..23!...\i]...n.!...I7}(.V.'...x. .......nDB..P.^.1..A.l.-..h.r.BC.Y........7d.......\..Uel^.....^y./...?.W..0.(....K..tg..l.......4.yYQ...HJ.:T-]!U.=TB..=?..s..'.< #yE<..`FY.g...t...X........c..]!b6...+....NrX...&.I.v.J.d._..{.]k<q..?......<-.......u.7.Q...*v..#.V..G.A...?.u.{.,..%\0L%Q...$M1+.'...=}....S....w.....0.~.BQ....S7A.A"TL.4..]..=.....}...lJ..".o.w.........9.N.fKN......D.}.........uE.f..(#../....gw..._o9..!Mz....A...;\|...tn.#.<.f..q...:. .F+K.......X....^....C..../.Pi..a.{=[.r........VG....G....W(SY......:.u$.z,X.j... ..e......Q.AFs...(.h'........M_9WU.....5B<.....>....pE..7....Y.!,.2U...YKx.#&Y.<+.f.0~.R.E..J.Q..##..;IW\=..P...Vt.......hm....<..p.<...D.D..X..1..2.i04yzo%+CN._..MH..a.%....I.F......1...i...u.I.>+.G.n..<F,y.@6.iC..S..@>T3..Nv....;..^N\|}../ihys.?..2.\..KB.ln ...2.m/..R...Y.mp...m.7<\.ax....H..I0Y...

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv45.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33413
Entropy (8bit):	7.994738128765888
Encrypted:	true
SSDEEP:	768:byWV4zwDjLTC/6c32Cew4cflNwBEm+AnBLB3TO3Kxj:YwD3TC/JGNw4MlNwDNBVC6h
MD5:	CEC8262AEAE454048A13FCEF64416666
SHA1:	48BF36FE244FC7300195796678D8D560032B718A
SHA-256:	BAD738A7A5E22A0B4DD9C6A440FF722D75B562F0D7E3052427EDE9F57BBC9EF6
SHA-512:	077E68C3C5EA91CAF3DA8EB91BF0A117CF83BB76CB57E4F54106D87A18D320478E4643CDC96C03CD9B94C6D10E7F79C87500DCBB0C639EF51959FFB38A7A2D0D
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7...7,X. 3g..XT..B...0.RQ\|!..<.s.y..o.).....}=jW.........0.....A..4.x..9E.]..../9...9..q..t....o....... ..H{.......y3...CA......9....FF...?...F.C..e.}..B?.;...P3.NY......o.F.M....$.bn.]R...6...A.l.$..n. ....!...is.6'. Y.m...G.rSB-t......<E..2S..;../.L..H.....'Bc}f.A.HIw..a...fc.c:.^K.c......t...`...q..p.D.Q...Kv4...4.9\..@......x.g4d...S1....6.6D...?.J.H.)...;.iQ... ..C.......\|5...oD.c._....b..'....z..2..\..cc.\|R.yCU#..N./.v..@.\'..H\f...eo.6.}..].......'Z....?"c..FH+.A.....#..X..u..,....Q..>gB{\. G...b.=.....Z\....i".>?.....X\..\|J79..,...6..I/..[..,..g.....".;...C.m.....(...U../...&?..2...!.......\t*...~...8e;;:A.....`z.%....8.Hk.>hl......-L....Lyi.p.j...q }z\..=.;..=r/.1....m.....Y..3.K.[..<.....].0..S/.d.t.WYn.,Y..%.M......cYpL.`.C.<&.,.....h..&.Yf8R^..?.h.z...)..h.5h.'..@...W2.n..a.....l.WIT.4.Z..sk..g.V.k.Axs....a..&...a.....b..'.o...6Fdw.;...!....^D..2P^...a].L..^..Q.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv45.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	65702
Entropy (8bit):	7.997244020702617
Encrypted:	true
SSDEEP:	1536:QayRKcGIakNwN56RcUfoZHhn0t9fAIH8TBOg:oRKEak+N56RZoZNu7H81Og
MD5:	C6607EDBDDFB082E9BA6689D3AEA1E53
SHA1:	68FED24E716D40BBE87B8A0A34B19F6D8A78D151
SHA-256:	F082CAC36BBBA6DE1C63C117C7088EF6467471358ABCF0941686CDD7A87BFD3B
SHA-512:	6EEF8E376A5E21E4F0750D0849CA2C0AB76D77DCB69E21908F5B2A4BAB9911F4E2CC504C4CEE0DB2696F21B236712D3DF13DC74CD01522AE01C0677C497FD3A9
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7.9x.R8......N....@DiJ.MHYD.f9..:..y.r....a.Np.V..bQ#......."l.....4,P."pe...>...>..x+.....yC..)A./P..\|..E...V....(G.m\|...s.m.h/..q..yP..\...64.;..sZ-Y..4"..0+m..........4...oO.cb.....M..........,..Q...=8.E..pm.9.......6..s.].......BZ..{I<f)h.....\|.~..-.y!...Pn..%.R.......\|............kF..z....nZ\q.i{...$...jV.\y.Bw....,o!,..\.....8.....K+..O.^...Ia....dI.?rK.Dp8f.Qs..&...8...#=1.<.....0..(....Z.thXq\|....4Z3t.....kY...h..?..._.Uw./......3 .........}..H....U...%.Rs...p.:...8HK@...m...OgW#(.F..(L...dI.~0M.....(.q..J..8S.....)..t.6......>h.5.5 ...N-....3 .Ky}X..C-....]...+..Lyk....?....u.F;Y...D.....?.L_..qT....:y(r.].I.r\|...;._=."$.0.\|.....sS......N..../S.,...[..S...O...".B...,...jV..Z.T.n.F~b.R...=.x...\.Cf.e..``.:8..$...&.4.....C..l.R...X.lLF.`yZ..\\V._...\|5...V.....A..O....\|.;v..D47).%."Cdw..]...K#.+I.......;hEC......8..8.l.6.i.+.G.n;...Y.-aO5..N......S...Z...z.X..*.y.&$

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv46.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	87089
Entropy (8bit):	7.997443715084655
Encrypted:	true
SSDEEP:	1536:k8LUgVYfcS3/AvCcvyQ8FZPXYjkdzrMTfOEvXcc/KjRqVGeS5owgq1O:bxccSPmv/8FeodzAz+cCjRqfatgL
MD5:	9FB28A483FE0F6E313424ADC933F2018
SHA1:	D9A04488876058281DDB52E8CBCEE17E65FD38CD
SHA-256:	844CAE30A329226B37557F2A4F5E3EC39B9BA5668F0FD85535121D17EB05D051
SHA-512:	EF21FBAA9F5DA834F2A0996A2CDDE8E94CD061A25B11BA75A3FBD57A04BC01B6F315043058D4878FE0B7E751877D93A84441B7162ADA4B99AB93322FEE8B51DB
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv46.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	19144
Entropy (8bit):	7.989739913507628
Encrypted:	false
SSDEEP:	384:1Fr1b+1SUYj7Jb4sSC/bydlgqaSMBYRy8dhzRuI27y8OYRMHfw:1/GSUYeH4qa7Yx27y8Yfw
MD5:	0CF5444E3F86C21B31BDE867F575EEAB
SHA1:	D81B7FB4178FDBD274DC36713A95B85F7B2CF260
SHA-256:	7C9437E6BCA2A03FB75E5EE49F4215BC96FC295FB0C2CA3311FB61559763B5EF
SHA-512:	D0F1DD79EF572E3BB3B01F454914957D7E2D80494FECC025286CE2A87AA8E370337D47EB8CDB85E7CDEA9D841C46BC4A9E1AC831B0DF1B32512B689EBC429F09
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv47.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89125
Entropy (8bit):	7.998059583264308
Encrypted:	true
SSDEEP:	1536:3VbDgMEb5eSQUmNQnPmYBbU5/VqU1H1X1/1wenEm0IHEbd3pzDqBOot/8MVnW0YZ:3V5IjQnNiPmYxm/L1Z1wenEEEbj0p58F
MD5:	80D5F631C0C99F56A4F95A4398D5753F
SHA1:	A05A2BACCB9C0C2C412D83246FE2E8BAB03AE801
SHA-256:	9C67AABD5894663D4A71D7605753681861C4807A113E554ED5EFE3A6637B57F2
SHA-512:	D1E07976B24BF196E90CCA67178734EB01C704F40562FF62B735C4CFDA2606CB106345041876C7625ADE4737123DDD966FE4C7122A1033B08FC856F299B2C787
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv47.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	21103
Entropy (8bit):	7.99184395160347
Encrypted:	true
SSDEEP:	384:1FAWMNOXM3Le0eDPfrlvKhNHvbysE05FT2jBgf5HFzB5+gcJGaIlK2cN:1FMrLULlcHOiFTeKf4WM20
MD5:	7A962A158FAC54BEFD5EA4277A549457
SHA1:	414925688F195194FC8BF8363F75395EBFB6638E
SHA-256:	76EA5441F6A6D54B07B269CFEDB92802AE31C66ABDB1AF4FB9ADC822A5C56BB3
SHA-512:	626DB8B51CAF686AD08AE061E6AFD940A9B8304C5248E546D0425ED333673D1DA63897C75B68E06F015FC00DB0AD754364767FDF655EADA36C262D4DC0818E4C
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U......U._..(...&...l.F4.@..R ........~.....Q....P{.cM...K4..\|o.C....jQ..y.)..p.......J..a......j}.A$:......<.z&.?!u].h...E9.n....v.=.....X ..q.i.....#../"~...?5;....LK.(.&:b..n.<......ev.i.)>.4.....EU.^...%b .....aG..%..\|1ql..'O.M..:cs..w...P...tgkF....3.Dp@..z6$.9r..M:.";?..'>QQ.s.. ........C.)+<...!"/.._....}w.q.O..E.+....u.8r.wE.I.9.?.b.....e.a.....DHR..z..+y..-7O.5'...6...c...=v......X..C....m...........V....m..l..VZ"...8.Z...=.Q{z.v.i ....;&.Q....0x....7K.{Y.....M.M'r...,.....,....:3_.].qx..^.bm.[.a8.......7;.Y2..Y....lx.............\....=.1..u.Y.H.....m..."..aZg.Z.n..t.\|l..O .

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	85952
Entropy (8bit):	7.997723746290305
Encrypted:	true
SSDEEP:	1536:C+uxy76lXk9ZBFLYZmJuPx8u6nkVj20LobXHK0xwrhXC89cQ5iIxloOXZMnwN6:C+mg6leZBJuPyu6nkVjzobaZSQFoOXZc
MD5:	1AB21C5CE52A3B96BDD9CEAD9FDF91F2
SHA1:	C9DFD5ED7BE1A3FBEC25E571A2DDA485661DC50C
SHA-256:	7A41283A414F42D601DBCC159237BAB46053F34E54617E5B5C46F71DEC29D35E
SHA-512:	A8E2EB103DCA9B0BFD293C84D7E8B13C610BD28ABE697327AF4C6FF1FE5D5B693DED1D2D5AC8F853F96A527903E9D77B021C0844418044125A06EF2CDBDD32A7
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...{w...<0.......N.r4..T..yZ..U..G.....r`?.}..A....'as..a....D..-W...!.A..P=..M.L........TY........[,..u...z`....4.T....2...j....aj.yy>....B...a.l.'..r#J..q.7&...9;!....V..>u...nA.-..:...69.=+U........i....h...K..s#..k@..VL.U....,.n.6S..}......`...e.}....G...?..%.w.M..9:..... ....-.^'+.t...........4/...<.....0G!..X.b._5.....Y3...NHf..d.G..M..7.b....8T.prgS...DK.erP..A...e.....d..I.V&rz9.}.'......W8Ij.-....l9.....#G.t(..&,....ytNoz...]2..k64+Z..M.........mOPX.;]...h.N.C&Q.V.....X.#.O.B\$..q....Cq.MgE..2.j9u.......r..r...U.k....1..8.b0.jW]!.UHN.....8.7..m.Pg~e..e..+X...{..1>~...FJV

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	66675
Entropy (8bit):	7.997200345251726
Encrypted:	true
SSDEEP:	1536:Zb5PfGKN+w1JgYWhXqYnMYsrhkLaLZjtGbEBd0sea5otHQqGrXi:ZNfGK7gFN2rhkLejqEB+ae6Xi
MD5:	BFF1266CB467298E1BF77139D09345E1
SHA1:	1FDD52F261E8A9B5FD57AF4EE2B8B7BB4EC99B7E
SHA-256:	A35D6A6DF0B4A1D66438B48317D31DF0926500CF03A439413B76C691559DD232
SHA-512:	ABD217D6A0FD94F20209CEDD9A0AF561CAD71DDEBC3B2D7BBB82BF0F9799D143489C9D312565871F29BD7DF54983F52A17F3F27562EAE7AAC8CCD487796C9D91
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.....5.[.....Pf..V.z......L.#.z.`-I..!.N..u....pM.&..sDYX)U{ t.v_U.ML.w..eg.a.1......R.q...."..K.m..z...{.....`......uG...:...[.....`#....&p...2...x._-....!C...o..o.\..l ...Q.H..h9%.a..'.8.........S4=..Y..d...b...._.. .'..7.5...`@..0..@......cP.0E.....9....g...7\|n.%!a.&.Y`b.8.....A .....L...r...Q...R~..zZ[.3.....H@.c........K..<\|^...Q.0/[..@.<[..#....`?'gn.x..".....7.Z9z9..z.Q.o.....0..:7.O@.......2.gcb.Z0@.&.&..fH?.~...5.`a...s.B...J"B......q.t...!.#......".G......t.`..t..u...3.i.,..#Dz4...\|\|t...".Ll..Z..*..b.f.....`.c..H.K........'..B.k7..sd-O..j-..)Oe#.80#....;.Q..Cb'..r.Y..Smb..{

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.5.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	92378
Entropy (8bit):	7.99814110360773
Encrypted:	true
SSDEEP:	1536:tgnDfdhbCSGXIyETXN5YYY0JLgpaXw6Ued5488BBccIHkBrjAzcvO+z2onUmGa:tWXbCSGXtE9gpaXf4nB+HIrjAzcm+5UY
MD5:	2A8322657D20CCC866150BEBC9630AEB
SHA1:	083C0665D5F92BA9B9C0FA8ABD886FFDE99EA508
SHA-256:	BEF7BC80ADA71D2AD28950C5B2B291513E913B2A65A802CA0384E40759942274
SHA-512:	62B6E106F9E9C55FEB2A706C307005AD13B3C2D15A388088BECC34AEC3EF82D9F9E17E6AF75B5EBBCD3DAFF6EC22EAAAC240CE995B07495F251AFDEC13073A69
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.6.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	38466
Entropy (8bit):	7.995165443733207
Encrypted:	true
SSDEEP:	768:1/7cEIBwv+fMziSAhjeNhW5iJgAGXykYEZAA0vea6rosyz3sL36/:udfWA0Nhe4NA0veaBz8ru
MD5:	35EF6B79DA388875331B47C2EBC2F47E
SHA1:	C2600F156D2D9CB3A8B951A3C25D5C18BEE3B8B1
SHA-256:	3CBE601BE6588C29EC451529BA99FA9288EA2B9F06FAC2D9EA9FD2ABA17F8D2C
SHA-512:	86E6C72C1B197F91ADE214A0513936C1A46FB8FA26EDB03E2DA8967902EC76401BB613B3D2D987F77CF0692087AFCB01465BE5C1ACF67716757D69F4842A0DF2
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8....y/}.7.o........

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.7.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89262
Entropy (8bit):	7.99808539753097
Encrypted:	true
SSDEEP:	1536:SBDbRlbqNtRyZzp9wPK2yZEpbykFf1hyM272MsOvupyNi4DsuuYh9sG:QX2dCx2yZYbXFf1w1vfBDwe+G
MD5:	AB299939F803241F523C0CB4D6B4D0C4
SHA1:	1D76A8DE56E56BADD3488B9DE1C6FCB58FC65074
SHA-256:	A5433FC2217D43866965AC1DD3400E09C43E69CA465DF4CE11AF778E77DA24E0
SHA-512:	1338BE1CCC39312928A8048F3D813A90F521E10FE01DE2141F80894F4413E2A026C8981F5A896132D6A6592313C3166C5E4628D3681258AAE3499B5E2344C9B0
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.......j..:...].._.~h...H[2.W..H.(....<.Xo2.........!.=.7`..r..}..Z..y..T...N.[0...{kT.k....U@.\|.....<...U..[.2..iD..l#..X..Q..I.".Q..0fP...opoC..._nag..G...H.H...J.<..j..5.$,...U..IO..a...........q..m.....y=.oq...]e.{.t.......P...8q..yT{......@L....sq.$`..c3~.\....^.?r....W.+.A.;.Tu.`s..w&@e.i=.}.......C1b.....[w.s..X..7...0$b.....B.]...&N.../.t'l\yC.*k_.V.....\|..u.......T.R9.dUk..3j..I.6.L.c...I..r.x...+.>.!..-j....;.}...Cov..[mi&....R.vy7........k.fG)lJ...:..../ni.{....L1.M.."z.G.."f...40...`...w.ge.^..7..k...Q_..k.7..<K...P...gK....&p.9.u..z./...l.......^Q...q.n..A.F.......`.j......B.mr..;

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv48.8.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33470
Entropy (8bit):	7.993865224775696
Encrypted:	true
SSDEEP:	768:1xo/WOGzsaLDQvG62vPagGSteIjjdGq1tYY2LsLpEZ+i:eWOGzsaLDQO6WFtjMsRu
MD5:	A95E284BBDCDCC82138270A29DE31376
SHA1:	FB4EB3AF050A86CF27A27B092EA086BB52F5BE07
SHA-256:	F9A5A71B000D9057942813FC2A61D8D5CD2415F5B60E75A1928D4D38EFEDE15F
SHA-512:	4AC1E3354F5FC2596D39B9E1887F06193795214D569A178AE3B3E35CEB706D2BCC10615FC92F7629DE0763F9B6C79B2479444C37388504CBFF37882421699AE5
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.....'p..~AS.tR.W..o..?ug.....7....p.@..:D....k\$,l2^..I.{.;<.q"[Y..v..r?f.....:#....F.0...;..\|...U..&.t.>.........q.......4.)M..R.la.=....U\.uR&..K...L.D9_....D..?.].h{}.<.......z...&C.]y.;F./.N..T..bq..,..r.".#x6".......&...!..9Rd.k.i.W........D=..d........$....k(...%@..Y.(......tY..;.?>.cq....]6N......d...HJ..GS.x..T.......(.Z.DY!....C..C.pb..Q{..HE ......."..p.h...k....fTas.C..5k.3i4NC... .e:...j"Y7.x.k...4......as08.J...n....\H.....W.j;7-v..D....1o.E..../+..TQI..K.'..694....ze..'.gR....I.q\|..j.1....:y...u.....&M..s.j..{.>....,.5.-.r.f>L.^OZ..g......P..+...q...n.3:;I>fs.Y..>.b..1.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv5.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	90055
Entropy (8bit):	7.99800317558275
Encrypted:	true
SSDEEP:	1536:BW6/qkkUUtEvO438Xq3tgPDnDfNScYDrcjO5H/kNMPE7AEbFAtqWuV7y33:oykUUtEvMqCnfUcYDrf/Qv/8qWEq
MD5:	44ECC1328F59A8E238B7CC0875D8676B
SHA1:	B8E208314A05A58B4C634B65786EAB5396E0A163
SHA-256:	ADA56B7CA45E461C08E8B3DAF1D3B0139ABC31B05DAAC06655FA8A4064D8667C
SHA-512:	E45EF02ECE30F63442A37D8E118C8EA2173B007526F1A8A59EBEFBA73098DA0EB2E3672478FCA75B929EB1D93E91932E5BF9E5275E5F656CD1CCF1BB9B8DEE15
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv5.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	22440
Entropy (8bit):	7.991781976298273
Encrypted:	true
SSDEEP:	384:BW6NhjvQ1XoKt/0bGVsZ7aq5u2DGqEb/LBphHZn4pQgYuxAgdzBnw:BW6NhrQ1Xoq1sgxLqEbLBD3gz1dq
MD5:	B0972A8D56CC2BC157A681D59FB35966
SHA1:	A0D9AC2EABBC73D8F157C7E1468DFF204AED7F02
SHA-256:	B04C2BB17C93C9D202514E8E83FB557F7CDA9197D916A9E786EF3C0D517DC412
SHA-512:	9A1E42597A89728B842CEC70CAF81194BC4CCA368A97BA22EAA31F6AD4DE9EC24911839050D1369D5A270F45355CD4AFEDE8430C0FE74E486759524779052A04
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv6.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99229
Entropy (8bit):	7.998172009274098
Encrypted:	true
SSDEEP:	3072:oB70QLzwr4HrXnZZkbBYb3MBPBaqALCGUtJJ:i7PLzweXnZCm3MFwqMWJ
MD5:	C02DCB97546872D163EFF9D291CDBFD3
SHA1:	0BDA89EA75167768D9A08A1FA6ED6E1CC686EFEB
SHA-256:	03D9526D1AEF606B1FA43C127E7B1141AA568FADE454C1C0060BB9C732E0B626
SHA-512:	66E748A8560A8A2AFEFFB5A176E463B6B0A3E45152E97ED6B2C3E72C616AEC3746D7B5AEB8F87EA97E657C47914680171D7F12FC2221D6D2173533EEB2B45AA3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv6.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31788
Entropy (8bit):	7.994731967225481
Encrypted:	true
SSDEEP:	768:BW6N6D8t1j8MyZVPL7+dbD1VZMufi2LGxwxt7tno4moX:BW64YtBy21UQisGxwxtRGS
MD5:	7ACBE69D3B767E94BD59B48104364992
SHA1:	647C91290222513C2AB94FFB8A36F70FEFF265B6
SHA-256:	593CD5BA79A489C4388809E17EBCB32AF9B10EBC33C895955E13A06CE8F48C43
SHA-512:	EE5D2EF06A22F741167A5BEB219678BE65B9BFF4F258F0BDEC587DD9A1ACEDED199485B4664C9B870775B105AAB08916DD8FB36912C978030E55EE5A66B38648
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv7.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	97511
Entropy (8bit):	7.998029934840964
Encrypted:	true
SSDEEP:	1536:BW6YRAslfDTP4mykxKthRKjv4UCAnhfIMHsIeIVmwRXuZBDej5l7ahUn70N2x9Ro:oesl77DAhBzmRIGsWR8FejX4i9ib
MD5:	53BFA45DC4DF8F99473480A954EF3981
SHA1:	53A74C7CF7AD41FABB4609C7EEB5BC3428B55B1F
SHA-256:	A0F2039554A03DB416709C08D36012CBF5A8EA313C258A58B7EF43DC947A1AAA
SHA-512:	86E390863EF48232BE511B1035A0B58888EE25FF708C659DB94562DEF0EF6B4A1907EDB00287612DF4F91A13647D9471FC0ACF092E225A009EB9ABC38D4B0A44
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv7.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30258
Entropy (8bit):	7.994163063127342
Encrypted:	true
SSDEEP:	768:BW6NiqLRJ1pIsEine4QTOvc8k2VIx3b+mUZhFs/eZ:BW6gqHjEjavc/ZsFh
MD5:	F2320A86A314A2B869E484BE85AA6DA2
SHA1:	E4DD98178CC70A9C3861BE10539DD9EE44797F0E
SHA-256:	C0908DBA50A0B348646C7D12E7C2E247EFB76807C7DDB8911E9D4A354ECFD320
SHA-512:	D9C5D20CFC30A1C476B7C75549CE328A8E0DB273BE7D95AAA3682EE9B2B9D5F99FFF38D0B1DEA610B39B22B4B6AD76ADE47E164536D13BB12DAF6D0316BB8C57
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv7.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	43405
Entropy (8bit):	7.995486194210034
Encrypted:	true
SSDEEP:	768:BW6N6duWjixltgJ/YtP0CFdNOek7IsT/KsQc7T5sFYBGdqxWMl6NPjAu:BW6UdAxltw0TNOt1T5kNdQWMENPj5
MD5:	038BD3AFC1C645309EA2AC8241FAEA4E
SHA1:	5994BCD83A0FFC73AC95C04E72A760E0CDE69AAA
SHA-256:	62EA1884D2CA67157D5B5706EA9ECB04CEAC87EE43C6F776849075D6EF77558C
SHA-512:	4EE4834975DCB18F0752FF82FE22E0E72BB658FA210088F8D29C7AE6BB0DDFC4D3CE624CD4CAE777429B32CA63997EFBAED87457A599D315C2314B6360E3C2B4
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv7.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	59084
Entropy (8bit):	7.997061813185959
Encrypted:	true
SSDEEP:	1536:BW6sdKNDauCui6bsn6ueXzMDGMw5AuOGt1K2qyuqdMUgOlKSo:oFdA+uzbTWwoGt1Hv3o
MD5:	EA95C5772F569691D94170C70962F47F
SHA1:	BC6FE7868B681FF643C78F7B02B2C79A7FF6D53E
SHA-256:	2F47E1C26AD874F6D7DB789195A379A6C48F0FD6C29CFE074A1B5EC5ECE975D5
SHA-512:	6475BDA81B9E27E6873794DDDF6118E36F7B7F5E47CECD682C078746B9ADDA5BDDBE8CAC63E794A0E63B3F1E53D946B70B0128795AD1B134D26D2246F19BCC41
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv7.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81522
Entropy (8bit):	7.997658728209986
Encrypted:	true
SSDEEP:	1536:b3X4cXIoB/iOrydkB5xlW5mYiUBse73BnDPO/tGVI0zfJrNcO:zX4cJ7ydkB5mS8sm3BDG/0I0xcO
MD5:	C73202DDFB9FFDD67A33F1DACAB45698
SHA1:	64A4CF5CF5F44FEDA94DC39598D72A87E822AA90
SHA-256:	4605673AD3A8E30731A88C0AC09350B4691D6FFA035F7780213AA43A52625B1D
SHA-512:	A2FBAB8F0EF496286D83C915427021D393E5709C00244B051AD9785B028919FE8EC5A96E40597A94C95A79658F90229E59379FCDF4255AAE8C22706033D0BD2E
Malicious:	false
Preview:	.#D...e..,....<....`......./\.r49FHl#.:...\.2,....W_.{.Z..E.#.L..B[.z....S.N.....Z.On..eT-.m..t.%..K....Gc.y...r....FnD..a.....r.`.@.I...e91Y.bh.......F...~#..........Y.>.]X.O....d.d........3.FN.O.9a....[39.xdw..........C...h~..\|..Q...i.[...w.8.w.xz.....H....v.......e.OO.3..ul...y..3...`.C.,.1.P%.cw@...v..\ .......O&.M.....+..NI.0......5...y}..V...b..(_.l.).q{.in...dRL...mm...?[..Qjx."f"..]>..P.b..zl$?.f'h#z1...?..c.\|.0....... .>?.j..`<.o.S...+.\...U.l:._U.-.."c.#..g[.W.V)?<......&....kzR.2.....N....;-K...<aS.....1.Y....w..7k/y.MS.S..\|....W.9...q.U..d.0T.......;.l.......%..... %.T...l<...7.i(2]?......Y.....Ni...j..R...@....3....z...%..[.,..f..9].....B..'..jGN../.3....tF2.....4...I....C:Q6.....B.1Y..K..P@..J....:!....H......Z<..iC....l.p....\25].Se.A..#.D......i..........G[......)..I ..#[....Ln.O.W.']9..ht.p-...O.F.BAcK..Z......^.....K..`..-..1,.....j...e.v.>.l.{D.1"&..RV...0....M.X..0...~./...]..J.w...;.d....".....d6E..s.R<f.

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv8.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99558
Entropy (8bit):	7.998126987043341
Encrypted:	true
SSDEEP:	1536:BW6i/7u5pOXNGa8SHdDghoUY5IxeOvcrLK82rYi0AH4THvDR6g6dRQ5c:ovz2IXoa8SahoUPxeOkrW82aZb7RIQ5c
MD5:	DA245CD9A3C4B3C3801D3AF51F65669E
SHA1:	B4CBF06B1741C6F11BFCB70AF71648E9CD303AFA
SHA-256:	4ED05DA6232A33F423440381F7537F81D7A191869F61CADD46503A6219F61956
SHA-512:	4D7085D14DA5A9801503F42BDA2B638DDC39D3F7B2DC4C0F19D4E1F24257906711CBE88C5B93398EB26731532E8C2D649E629DB32782DF41D8A8A293D0C3BC0C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv8.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32921
Entropy (8bit):	7.994624642930536
Encrypted:	true
SSDEEP:	768:BW6NewJwOQjdH/VducqYXlA3KZQcd61iEntb8LGAv6kpUtk:BW6jJefPqYXa3KNdHEtb2Xv6kKk
MD5:	83F1BCCDC2F210D7DE086FC737916F39
SHA1:	9CDE2A6162D3DA680ABCE27F73014762F9F3ACAD
SHA-256:	B00A874071BAC257B2FD82634301D93F2EF93AD7B2B6FA4CA59081C674E58083
SHA-512:	DD1620B4445E53DEF839D461853CA5819624EC45CBB7794A7A564B5317BFBE2E0A4CCE29BCA3990599E2CC4D056889A0025AA70FDAE2851BBF3244B22F40BFA5
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv9.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	95672
Entropy (8bit):	7.99801011413176
Encrypted:	true
SSDEEP:	1536:BW6YIBIE5MDNsiGv7/8/ieUvSZZht/paxFn9UyFELTsX3wt2JIaG0Q1WWTRDdXLo:o5IBNMDOHvL8avSXht/U2yFELwXAO1Gk
MD5:	4B55B9B8CD72784B8F4E86594C976C38
SHA1:	153DC16E17AD981DA1B8A9D990E00061D54CD49E
SHA-256:	9E3F1E22A087D3714AFD5E5C25817CB5D92F9DD158DBD5995D7E7B7FA7963C0C
SHA-512:	87E0FF6C0B087BC060F7B6F9D5A514FDEAB835A1153FC6A01A6D36E9765F4B9335C5281CB9CC832F0117F11030A104AB113057EDB6861508F8229870686C2E34
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv9.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30417
Entropy (8bit):	7.993108204768856
Encrypted:	true
SSDEEP:	768:BW6NHiPM2oCLwxHKaLMuIkdA/ceBdhiuP9vyRPMtoeVYbCluQ:BW6GLw418AjdvURPUYuv
MD5:	A227291090374BE07560BE98E820569E
SHA1:	79DE95ED367C987D0F2C009799E91C8D6EAD2127
SHA-256:	1BAC6A4DA0B8762762846D3828510696B82B9DACFC9341CF79A659863B328937
SHA-512:	21EFE5395D5CF59D60DABEAA2A6E83625571522EADD660C0EF1D599EBBEA5053ED381494EA46652CBD2AC994F09895F1249CC938F0BC42B28807815FE192F4BC
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\Nota Fiscal Eletronica\volume.dat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3835920
Entropy (8bit):	7.999954789583022
Encrypted:	true
SSDEEP:	98304:T1iNVBdaCHJ9dSc2z6ScJmMhyC2KwQSxffK9811uM:J0QU3euLmfxGUh
MD5:	77DE03A0A71F4BAD680C0442086FCC3E
SHA1:	F3732EDD5D446D89A99F17F81BE1736BC9ECE856
SHA-256:	259B7777D4455BC558EB1C89AD0A69151DE670A5D19FFA25F972C090BC3136EB
SHA-512:	398EC355492EC5F94AA81476BD32B75F7DF944E07B9E9CD7D92FEB6B94DEB89DCC9F2F8C7D3F80EFE1D8D7157D0D735CFA3BDA246D9BB7138B746C93AC2E08F0
Malicious:	false
Preview:	.....x^..x..#5y..XA..=.{$......E.....Q.ftk...z...~8.L..>.x..i...W....#BX..g.4....0...;.^....<./o$...u..b.._[MN>..^.....=.o'g.{J;.tx...T...Xiy....kn.h.N.f}...0.6.....).Q..f...Gp(;.+..%qu.B..p..qR...S.M......w0...,...gwo_.......w.Nl1.6..L=.5.M..nX.c.....#..{.....St....A.......A.A..K..t.HeS..Z....I...%P..2.........Z.V.L.H..5.U.1a..Y..._.`.M.?`Q......./..i..#{.....K..\|....\|...9c .....K.....I..r..m...g..5DPb^[yW^..v..+.+"....G$qt.)2W.-.....?.P76...3.. ...&...E..Rz.``..X...{.......&N#..?.;o.$.&.?....0......4l........E.}.\...-...X=....XU2......B<.w=4W.C.'.c.~nO....r[..%..r..n-D._....?d.q..q.m!....G...U-.....l.?C.Sf~Q..fF9."d:.&xV..a...[...A..6....Oh[4..h.._..;.D9{....RSm..m.~..A.-..N..U..........B.......;...-.....u.-H..{ z0g.<.-o....9w...A.W..Z....r&.......TRN.A...\~?ki.D..1..3.9.....o..:..5...rI.2........jz.t.e...V.......7..._..A5.`.-.p.e.f.Z..b.O....<q...F..dou........c..mc./a..I.....9...%..2`.Y..4..m...U)8.i(A.Fm......\.?.~T..

C:\Windows\Installer\53da2f.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {16DCA61C-6A0D-4F02-A29D-AC9E50B5C214}, Number of Words: 10, Subject: Nota Fiscal Eletronica, Author: Nota FIscal Eletronica, Name of Creating Application: Nota Fiscal Eletronica, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Nota Fiscal Eletronica., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri May 24 18:08:16 2024, Number of Pages: 200
Category:	dropped
Size (bytes):	23561216
Entropy (8bit):	7.97974744569782
Encrypted:	false
SSDEEP:	393216:wfwpJKaB9QEyLiZWGGpNmUwXTGH8L6O5oBvM18+fQuQY68WR3tgFJHciJ:QR5+ZlxUKTOO5sA8mQiB63iHrJ
MD5:	3E541108BD65DF0D1127E15711DA911A
SHA1:	EB6AE2A6DD97FA670DCAE50DAEF8444B3AE14CC1
SHA-256:	52459BFA76A1B8918E1E18C7B35B9A5EA0C4876E7483E2F486217E3059B6C234
SHA-512:	E81C969F96B522C4925BD18A474AFCF3425C32AEB4222018629D06D275011E5F75225420A664B890BA6ABB5C6779E801B868153323BE2A6F3D4A4671E9D68C6C
Malicious:	false
Preview:	......................>...................h...................................F.......b.......o...............................................u...........................................................................................................................................................................................................................................................................................................................................................................................<...............#...3........................................................................................... ...!..."...,...$...%...&...'...(...)...*...+...1...-......./...0...4...2...;...?...5...6...7...8...9...:...E...=.......>.......@...A...B...C...D...............H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\53da32.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {16DCA61C-6A0D-4F02-A29D-AC9E50B5C214}, Number of Words: 10, Subject: Nota Fiscal Eletronica, Author: Nota FIscal Eletronica, Name of Creating Application: Nota Fiscal Eletronica, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Nota Fiscal Eletronica., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri May 24 18:08:16 2024, Number of Pages: 200
Category:	dropped
Size (bytes):	23561216
Entropy (8bit):	7.97974744569782
Encrypted:	false
SSDEEP:	393216:wfwpJKaB9QEyLiZWGGpNmUwXTGH8L6O5oBvM18+fQuQY68WR3tgFJHciJ:QR5+ZlxUKTOO5sA8mQiB63iHrJ
MD5:	3E541108BD65DF0D1127E15711DA911A
SHA1:	EB6AE2A6DD97FA670DCAE50DAEF8444B3AE14CC1
SHA-256:	52459BFA76A1B8918E1E18C7B35B9A5EA0C4876E7483E2F486217E3059B6C234
SHA-512:	E81C969F96B522C4925BD18A474AFCF3425C32AEB4222018629D06D275011E5F75225420A664B890BA6ABB5C6779E801B868153323BE2A6F3D4A4671E9D68C6C
Malicious:	false
Preview:	......................>...................h...................................F.......b.......o...............................................u...........................................................................................................................................................................................................................................................................................................................................................................................<...............#...3........................................................................................... ...!..."...,...$...%...&...'...(...)...*...+...1...-......./...0...4...2...;...?...5...6...7...8...9...:...E...=.......>.......@...A...B...C...D...............H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIDD3D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: z1Pedido-Faturado-NF-938731.cmd, Detection: malicious, Browse Filename: arquivo.msi, Detection: malicious, Browse Filename: 25690.01808D.msi, Detection: malicious, Browse Filename: fatKCMAGKKH.msi, Detection: malicious, Browse Filename: SPMServer_2024.3.5.473.exe, Detection: malicious, Browse Filename: SPMServer_2024.2.1.7.exe, Detection: malicious, Browse Filename: SPMServer_2024.3.1.22.exe, Detection: malicious, Browse Filename: Df.mes-25664.msi, Detection: malicious, Browse Filename: FatRE012024.msi, Detection: malicious, Browse Filename: Fat012024.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDDBB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDDEA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDF43.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE0BB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE168.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	18790
Entropy (8bit):	4.836922878089509
Encrypted:	false
SSDEEP:	192:N76ILVRnJOJ3JnJjJjJ4JaJnJoJpJhJ8J9JEJkJuJ6JfJDJCJPJlJ2JiJkJlJ9JG:N7TzttRN665nUjLL+Y6EE+ppPOySIk/
MD5:	9DAFBEADE87FFDB01D2ACEB2B0F6CEAB
SHA1:	C745464EC3A099995E03DFE7B367D9EFF1EEEFAD
SHA-256:	1E80E921FB8F64373F512AA444743B4C82675CA02CB5D4D05B9805C2E7A75ABF
SHA-512:	1E5990C450A4DE9320BC4104D9D28C7F7CB7DCC0619753933558F4AC4D760232925F6E286EF3ED29405A23F6A535DAB968F5FA5740A0AB96B6B2AF2E9AA6EDB3
Malicious:	false
Preview:	...@IXOS.@.....@.z.X.@.....@.....@.....@.....@.....@......&.{CD47C468-A902-4164-B360-5693BA87F9BC}..Nota Fiscal Eletronica..HomeDesk.msi.@.....@.....@.....@........&.{16DCA61C-6A0D-4F02-A29D-AC9E50B5C214}.....@.....@.....@.....@.......@.....@.....@.......@......Nota Fiscal Eletronica......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{5B9BF2B6-368C-4FE3-B208-7E54B76F1DBD}&.C:\Users\user\Nota Fiscal Eletronica\.@.......@.....@.....@......&.{04467034-B5F7-4AE8-BA26-EE0FA212F939}B.01:\Software\Nota FIscal Eletronica\Nota Fiscal Eletronica\Version.@.......@.....@.....@......&.{76FA10C0-C859-48B5-A751-C686F58B6972}A.C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.0.tv.@.......@.....@.....@......&.{24CFBDBC-C785-4A5E-BCD6-EA8F672F9DA8}2.C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll.@.......@.....@.....@......&.

C:\Windows\Installer\SourceHash{CD47C468-A902-4164-B360-5693BA87F9BC}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1626764580977218
Encrypted:	false
SSDEEP:	12:JSbX72Fj4//iAGiLIlHVRpfh/7777777777777777777777777vDHF/p1aY0lXtu:JG/6QI5bBLanPF
MD5:	FB166FB4A5137DD7268106CA346A692F
SHA1:	ABF26FB18E51453ED4F79AB470D780A334BC793A
SHA-256:	5464D94E6B8445FC9E808812849BB4A3A9C95BBAF9CA920EFA654EE5A753E506
SHA-512:	DBD2A06B9728F1F64FCFA7FC4C829B537D93F0B8ECF731941F401DF06D95F7A8F756289689CDC6B4DABE39BA882C3AFCED2B3A125C1A3BDCC3F03358953FBECC
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5099724229674407
Encrypted:	false
SSDEEP:	48:Q8PhKuRc06WXJ4jT5ulMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:/hK1bjTpUDgBFgYEC0McgBFgig
MD5:	D7C4A783B1705A8E7995F38416FEBF66
SHA1:	934AF027366279B63A685AB5A4E8C343A214BBEA
SHA-256:	72864D022528470633173AA1CFF2BEE8257371A0E7963C42C597654BFF3CB0AB
SHA-512:	8BF3A379ABE35623EC8D2770DB41528F2D5C88AD1A83581BF2580BCD5B75AC29FF4EA372A6138A000087C4EB085BB67944C99B5F3230159C85BF711E4FCDA31A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375171046480833
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau6:zTtbmkExhMJCIpErv
MD5:	3B7D73DEBA0EE70CE95E1E4DFC0210CF
SHA1:	BD60847828870E85363FC615E5536EE4E99682EC
SHA-256:	10151E35974365E65367CC0C483E01A8CCA55A69B8AF00BD1937F985743F56A5
SHA-512:	2E3943CF8391CCD02C445B95C3569989B7044BEF5C2BDF49AB36EADCDFA31673B2299A3F938055DA906F2FD4E90453C21E442BCBE925A8946496FC98B66EA4CF
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF01F8A61A6F83E3B0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1B2B1AE4D46C4A14.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2145173863333034
Encrypted:	false
SSDEEP:	48:VdCudI+CFXJbT5ElMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:TCHzTjUDgBFgYEC0McgBFgig
MD5:	70F363EDF2EB3B2F0F30156A9FE8BEB5
SHA1:	C3A650022A8C6C1C657E8206D0B3C7CE3C05082B
SHA-256:	82839FBE060DACB3FD555BDD7D9743AA60C9016492F9F007C67CA78AEAC54FE9
SHA-512:	EA806E1A88D0B02EE50BD958050C3D730580381CE7661DDB4948DEE8CB4E3DC47FFE2F74576D99BB0DF953DD51E4A99B674C1709BFFA22E8D865E699BD079969
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF20CF643BE25625F6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5099724229674407
Encrypted:	false
SSDEEP:	48:Q8PhKuRc06WXJ4jT5ulMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:/hK1bjTpUDgBFgYEC0McgBFgig
MD5:	D7C4A783B1705A8E7995F38416FEBF66
SHA1:	934AF027366279B63A685AB5A4E8C343A214BBEA
SHA-256:	72864D022528470633173AA1CFF2BEE8257371A0E7963C42C597654BFF3CB0AB
SHA-512:	8BF3A379ABE35623EC8D2770DB41528F2D5C88AD1A83581BF2580BCD5B75AC29FF4EA372A6138A000087C4EB085BB67944C99B5F3230159C85BF711E4FCDA31A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF29AA714D001E56ED.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5099724229674407
Encrypted:	false
SSDEEP:	48:Q8PhKuRc06WXJ4jT5ulMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:/hK1bjTpUDgBFgYEC0McgBFgig
MD5:	D7C4A783B1705A8E7995F38416FEBF66
SHA1:	934AF027366279B63A685AB5A4E8C343A214BBEA
SHA-256:	72864D022528470633173AA1CFF2BEE8257371A0E7963C42C597654BFF3CB0AB
SHA-512:	8BF3A379ABE35623EC8D2770DB41528F2D5C88AD1A83581BF2580BCD5B75AC29FF4EA372A6138A000087C4EB085BB67944C99B5F3230159C85BF711E4FCDA31A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF49E483823D53DA02.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06975061905695978
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO/kQht1a3ojIlgI14Vky6lw:2F0i8n0itFzDHF/p1aY0lfw
MD5:	ACCE05BC955368430693160736ABC2D5
SHA1:	DCE581A3932BD69D6E513B07861DE15133E90A66
SHA-256:	ADA564B6C247593AE179D319353CF78FFE344901BFB316097897C78672026588
SHA-512:	040ED804EAD47F3C70FAC70E27DF27D06FB388A58D99576A7A91E0177ADE32293EB18ABE26183D64853D8511AA17F1DCC917CF613C961D2A5DD05D7CA745AF98
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF66716DC87A4382C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.11701339822426496
Encrypted:	false
SSDEEP:	48:fDgvTexDgBSCxDgMxDgBSCxDg/AECiCyjMHoLSF9B:LgMgBFgagBFgYEC0M8o
MD5:	78DB331FCFE8DEE2C115926343EA3AA8
SHA1:	ADD9732F0140E10A0D21A296521EB20690427A36
SHA-256:	771CDE5B61FD53EB4273C16E3E944AEB967B5E93DB4063C07BA1A06AB3C4B0DF
SHA-512:	E48785CE5A97653D7CD23EDBCE493052FD307818DDB342B83232497E26C1821A757ED7B1220A604B354F14F7F081E97226339FE1E260F69CAECA1E236A9D20E1
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6675F6C8D980D559.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2145173863333034
Encrypted:	false
SSDEEP:	48:VdCudI+CFXJbT5ElMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:TCHzTjUDgBFgYEC0McgBFgig
MD5:	70F363EDF2EB3B2F0F30156A9FE8BEB5
SHA1:	C3A650022A8C6C1C657E8206D0B3C7CE3C05082B
SHA-256:	82839FBE060DACB3FD555BDD7D9743AA60C9016492F9F007C67CA78AEAC54FE9
SHA-512:	EA806E1A88D0B02EE50BD958050C3D730580381CE7661DDB4948DEE8CB4E3DC47FFE2F74576D99BB0DF953DD51E4A99B674C1709BFFA22E8D865E699BD079969
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF808F27D5AC6BD4F4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8A9EA8E1CEF88136.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2145173863333034
Encrypted:	false
SSDEEP:	48:VdCudI+CFXJbT5ElMYBxxDgBSCxDg/AECiCyjMHoZxDgBSCxDg7TeDg:TCHzTjUDgBFgYEC0McgBFgig
MD5:	70F363EDF2EB3B2F0F30156A9FE8BEB5
SHA1:	C3A650022A8C6C1C657E8206D0B3C7CE3C05082B
SHA-256:	82839FBE060DACB3FD555BDD7D9743AA60C9016492F9F007C67CA78AEAC54FE9
SHA-512:	EA806E1A88D0B02EE50BD958050C3D730580381CE7661DDB4948DEE8CB4E3DC47FFE2F74576D99BB0DF953DD51E4A99B674C1709BFFA22E8D865E699BD079969
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB2188FFBC53DA54D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC5261587E7ECE041.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC593D2471515D277.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {16DCA61C-6A0D-4F02-A29D-AC9E50B5C214}, Number of Words: 10, Subject: Nota Fiscal Eletronica, Author: Nota FIscal Eletronica, Name of Creating Application: Nota Fiscal Eletronica, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Nota Fiscal Eletronica., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri May 24 18:08:16 2024, Number of Pages: 200
Entropy (8bit):	7.97974744569782
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	HomeDesk.msi
File size:	23'561'216 bytes
MD5:	3e541108bd65df0d1127e15711da911a
SHA1:	eb6ae2a6dd97fa670dcae50daef8444b3ae14cc1
SHA256:	52459bfa76a1b8918e1e18c7b35b9a5ea0c4876e7483e2f486217e3059b6c234
SHA512:	e81c969f96b522c4925bd18a474afcf3425c32aeb4222018629d06d275011e5f75225420a664b890ba6abb5c6779e801b868153323be2a6f3d4a4671e9d68c6c
SSDEEP:	393216:wfwpJKaB9QEyLiZWGGpNmUwXTGH8L6O5oBvM18+fQuQY68WR3tgFJHciJ:QR5+ZlxUKTOO5sA8mQiB63iHrJ
TLSH:	CA373335A69BC122D54D06B7E829EE2D0479AFB3873400E7B6F93C6FC8B4CC1A674255
File Content Preview:	........................>...................h...................................F.......b.......o...............................................u..............................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 21:21:13.837002039 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:21:13.842081070 CEST	80	49730	35.199.75.136	192.168.2.4
May 24, 2024 21:21:13.842261076 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:21:13.842349052 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:21:13.896001101 CEST	80	49730	35.199.75.136	192.168.2.4
May 24, 2024 21:21:14.952877045 CEST	80	49730	35.199.75.136	192.168.2.4
May 24, 2024 21:21:14.954541922 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:21:19.958412886 CEST	80	49730	35.199.75.136	192.168.2.4
May 24, 2024 21:21:19.961816072 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:23:03.037836075 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:23:03.338531017 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:23:03.945569992 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:23:05.154659986 CEST	49730	80	192.168.2.4	35.199.75.136
May 24, 2024 21:23:07.565568924 CEST	49730	80	192.168.2.4	35.199.75.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 21:21:13.702454090 CEST	49653	53	192.168.2.4	1.1.1.1
May 24, 2024 21:21:13.782879114 CEST	53	49653	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 21:21:13.702454090 CEST	192.168.2.4	1.1.1.1	0xf8cd	Standard query (0)	newsfoos.from-il.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 21:21:13.782879114 CEST	1.1.1.1	192.168.2.4	0xf8cd	No error (0)	newsfoos.from-il.com		35.199.75.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

newsfoos.from-il.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	35.199.75.136	80	2500	C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 21:21:13.842349052 CEST	97	OUT	GET /clientes/inspecionando.php HTTP/1.1 Host: newsfoos.from-il.com Cache-Control: no-cache
May 24, 2024 21:21:14.952877045 CEST	147	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 19:21:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	15:21:03
Start date:	24/05/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\HomeDesk.msi"
Imagebase:	0x7ff733450000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:21:03
Start date:	24/05/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff733450000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:21:04
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 1B2D85995D295580A3E8CCFD73CF5DB1
Imagebase:	0x9e0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:21:08
Start date:	24/05/2024
Path:	C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Imagebase:	0xec0000
File size:	295'944 bytes
MD5 hash:	EB67273C54E78DB4FAFFAB9001148753
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 58%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:21:25
Start date:	24/05/2024
Path:	C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Imagebase:	0xec0000
File size:	295'944 bytes
MD5 hash:	EB67273C54E78DB4FAFFAB9001148753
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:21:33
Start date:	24/05/2024
Path:	C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe"
Imagebase:	0xec0000
File size:	295'944 bytes
MD5 hash:	EB67273C54E78DB4FAFFAB9001148753
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	26.3%
Signature Coverage:	1.1%
Total number of Nodes:	380
Total number of Limit Nodes:	14

Executed Functions

Function 00ED07FC Relevance: 19.6, APIs: 13, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00ED0803
SetErrorMode.KERNEL32(00000003,00000008), ref: 00ED080A
__set_abort_behavior.LIBCMT ref: 00ED0814
SetUnhandledExceptionFilter.KERNEL32(Function_0000860E), ref: 00ED082A
__set_invalid_parameter_handler.LIBCMT ref: 00ED0835

Part of subcall function 00ED5E24: DecodePointer.KERNEL32 ref: 00ED5E2E
Part of subcall function 00ED5E24: EncodePointer.KERNEL32(?), ref: 00ED5E39

Part of subcall function 00ED653E: __lock.LIBCMT ref: 00ED6544
Part of subcall function 00ED653E: DecodePointer.KERNEL32 ref: 00ED6550
Part of subcall function 00ED653E: EncodePointer.KERNEL32(?), ref: 00ED655B

__set_invalid_parameter_handler.LIBCMT ref: 00ED084D

Part of subcall function 00ED67A0: DecodePointer.KERNEL32 ref: 00ED67AA
Part of subcall function 00ED67A0: EncodePointer.KERNEL32(?), ref: 00ED67B5

__set_abort_behavior.LIBCMT ref: 00ED0856
_signal.LIBCMT ref: 00ED0862

Part of subcall function 00ED62E7: __getptd_noexit.LIBCMT ref: 00ED6356
Part of subcall function 00ED62E7: __malloc_crt.LIBCMT ref: 00ED6377
Part of subcall function 00ED62E7: _memmove.LIBCMT ref: 00ED6394
Part of subcall function 00ED62E7: _siglookup.LIBCMT ref: 00ED63A0

_signal.LIBCMT ref: 00ED086E

Part of subcall function 00ED62E7: __lock.LIBCMT ref: 00ED63E9
Part of subcall function 00ED62E7: SetConsoleCtrlHandler.KERNEL32(00ED604D,00000001,00F01068,00000014,00ED0867,00000016,Function_00008619,00000002,00000002,Function_00008619), ref: 00ED640D

_signal.LIBCMT ref: 00ED087A

Part of subcall function 00ED62E7: GetLastError.KERNEL32 ref: 00ED6426
Part of subcall function 00ED62E7: DecodePointer.KERNEL32(00F01068,00000014,00ED0867,00000016,Function_00008619,00000002,00000002,Function_00008619), ref: 00ED645F
Part of subcall function 00ED62E7: EncodePointer.KERNEL32(?), ref: 00ED6470

_signal.LIBCMT ref: 00ED089A

Part of subcall function 00ED62E7: DecodePointer.KERNEL32(00F01068,00000014,00ED0867,00000016,Function_00008619,00000002,00000002,Function_00008619), ref: 00ED6483
Part of subcall function 00ED62E7: EncodePointer.KERNEL32(?), ref: 00ED6494

_signal.LIBCMT ref: 00ED08A6

Part of subcall function 00ED62E7: DecodePointer.KERNEL32(00F01068,00000014,00ED0867,00000016,Function_00008619,00000002,00000002,Function_00008619), ref: 00ED64A7
Part of subcall function 00ED62E7: EncodePointer.KERNEL32(?), ref: 00ED64B8

_signal.LIBCMT ref: 00ED08B2

Part of subcall function 00ED62E7: DecodePointer.KERNEL32(00F01068,00000014,00ED0867,00000016,Function_00008619,00000002,00000002,Function_00008619), ref: 00ED64CB
Part of subcall function 00ED62E7: EncodePointer.KERNEL32(?), ref: 00ED64DC

Part of subcall function 00ECB890: GetModuleFileNameA.KERNEL32(00000000,?,00000104,057A9A68), ref: 00ECB8DC
Part of subcall function 00ECB890: SetCurrentDirectoryA.KERNEL32(?,00000001,00000000,00EFD0E4,00000000,00000000), ref: 00ECB949

Part of subcall function 00ED08E1: __EH_prolog3_catch_GS.LIBCMT ref: 00ED08E8

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Pointer$DecodeEncode$_signal$Error__lock__set_abort_behavior__set_invalid_parameter_handler$ConsoleCtrlCurrentDirectoryExceptionFileFilterH_prolog3_catchH_prolog3_catch_HandlerLastModeModuleNameUnhandled__getptd_noexit__malloc_crt_memmove_siglookup
String ID:
API String ID: 3547682504-0
Opcode ID: 8ee3da4ac9e93d0f6b60f001d1a99a0c708654903ea575c7c2b670d287d2d0bf
Instruction ID: 4facc79ac8d4a36320d184092eca624b3470776f8f1a77d68b5c552eaab578d2
Opcode Fuzzy Hash: 8ee3da4ac9e93d0f6b60f001d1a99a0c708654903ea575c7c2b670d287d2d0bf
Instruction Fuzzy Hash: 9511E9657943006BEA1077B09F07F2C26D0EF40B05F84382EB246793D3CEE264439A6A

Function 028ADFBC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,028AE1E4,?,?,?), ref: 028ADFFB
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,028AE1E4,?,?,?), ref: 028AE044
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,028AE1E4,?,?,?), ref: 028AE066
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000), ref: 028AE084
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001), ref: 028AE0A2
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002), ref: 028AE0C0
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001), ref: 028AE0DE
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,028AE1C0,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,028AE1E4), ref: 028AE118
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,?,00000000,028AE1C0,?,80000001), ref: 028AE13D
RegCloseKey.ADVAPI32(?,028AE1C7,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,028AE1C0,?,80000001,Software\Embarcadero\Locales), ref: 028AE1B8

Strings

Software\CodeGear\Locales, xrefs: 028AE07A, 028AE098
Software\Borland\Delphi\Locales, xrefs: 028AE0D4
Software\Borland\Locales, xrefs: 028AE0B6
Software\Embarcadero\Locales, xrefs: 028AE03A, 028AE05C

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 6a792d35ef8af4438f95933de0b568bc183a599cc8ade6d2f8a738e460b9e06a
Instruction ID: 29ef28a4e3031eda6cf01b6af356c6d0d842bcf9df0bf8b71dcfd6238722a675
Opcode Fuzzy Hash: 6a792d35ef8af4438f95933de0b568bc183a599cc8ade6d2f8a738e460b9e06a
Instruction Fuzzy Hash: 2351547DA40319BAFB14D694CC62FAFB3BDAB08700F544835BA04E6581EEB4A9408E55

Function 00EC87FF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00EC8809
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000140,00EC89CD,?,057A9A68), ref: 00EC8825

Part of subcall function 00ECA6CC: __EH_prolog3.LIBCMT ref: 00ECA6D3

GetFileAttributesA.KERNEL32(?,?,00000001,00000000), ref: 00EC8899

Part of subcall function 00EC7D28: vswprintf.LIBCMT ref: 00EC7D3A

Strings

%s\%s, xrefs: 00EC8856
%s\config.json, xrefs: 00EC891A

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AttributesFileFolderH_prolog3H_prolog3_Pathvswprintf
String ID: %s\%s$%s\config.json
API String ID: 4060651296-1626143552
Opcode ID: 06136732e6f9802aa492c895b8dfdc82f1435207a9f3db9f23b185822a9f62ed
Instruction ID: 234e3f4ef4491160f556642857144782970e35177e99b5c155d52af991b616f6
Opcode Fuzzy Hash: 06136732e6f9802aa492c895b8dfdc82f1435207a9f3db9f23b185822a9f62ed
Instruction Fuzzy Hash: 0831A1B1A0025CAEDB24EB10CF52FEA77B8AF50704F50119DA209B71D1DB729B8ACF51

Function 028A96A7 Relevance: 6.2, APIs: 4, Instructions: 152
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 028A96CF

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 548ffd0666c8d7a786e77baebc2212a45039d324c3c4d97dfb657907aeb411fb
Instruction ID: 05318117843483209935247503a8847e4416a2960b456b93d82a9a44dbffe2d7
Opcode Fuzzy Hash: 548ffd0666c8d7a786e77baebc2212a45039d324c3c4d97dfb657907aeb411fb
Instruction Fuzzy Hash: 3A517C7CA082448FFB25EF6CD0A475A7BE1AF48314F54486AD84ECB241DFB4D895CB12

Function 00EC897E Relevance: 4.8, APIs: 3, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EC87FF: __EH_prolog3_GS.LIBCMT ref: 00EC8809
Part of subcall function 00EC87FF: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000140,00EC89CD,?,057A9A68), ref: 00EC8825
Part of subcall function 00EC87FF: GetFileAttributesA.KERNEL32(?,?,00000001,00000000), ref: 00EC8899

OutputDebugStringA.KERNEL32(?), ref: 00EC89EE

Part of subcall function 00EC96D4: __EH_prolog3.LIBCMT ref: 00EC96DB

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EC8DD3

Part of subcall function 00ECA72F: __EH_prolog3_GS.LIBCMT ref: 00ECA736

Part of subcall function 00ECC49E: __EH_prolog3.LIBCMT ref: 00ECC4A5

__time64.LIBCMT ref: 00EC8D8C

Part of subcall function 00ED5F77: _malloc.LIBCMT ref: 00ED5F8F

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3H_prolog3_$AttributesDebugFileFolderIos_base_dtorOutputPathString__time64_mallocstd::ios_base::_
String ID:
API String ID: 257939070-0
Opcode ID: ffa3744caf9a958492f5f03b15ff870668b3b2ab50028fdcaf50f08949363654
Instruction ID: 29378c95ec7d0b1ec7a71956a7437d8c156388661c3e523c34443a3467ac861d
Opcode Fuzzy Hash: ffa3744caf9a958492f5f03b15ff870668b3b2ab50028fdcaf50f08949363654
Instruction Fuzzy Hash: 29C182710083C49EC331DB64CA95FDBBBE8AF99304F04195EE5C9A7292DB71A909C763

Function 00ECBA0E Relevance: 4.6, APIs: 3, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECBA15
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00000001,?,00000001,?,00000034,00EC88E6,?,00000001,00000000), ref: 00ECBA47
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,00000001,00000001,00000000,?,00000001,?,00000034,00EC88E6,?,00000001,00000000), ref: 00ECBA9D

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CreateDirectory$H_prolog3_
String ID:
API String ID: 1242296583-0
Opcode ID: df43a792eaef208d0031ca3f35b70121b9b2b005c1a17062b8b7524ca94f6190
Instruction ID: 7e95cb082f6e917d9a0fddb97f9863390193f3cb0282cabe76e165869d4a2ab9
Opcode Fuzzy Hash: df43a792eaef208d0031ca3f35b70121b9b2b005c1a17062b8b7524ca94f6190
Instruction Fuzzy Hash: 00112471900108AEDB14EBA4CD96FEE77BCEF15310F54211DF211BB0E1DB629D8AC661

Function 028A6510 Relevance: 3.8, APIs: 3, Instructions: 30
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028A6526
Sleep.KERNEL32(0000000A,00000000), ref: 028A6540
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004), ref: 028A656F

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$AllocVirtual
String ID:
API String ID: 3510833457-0
Opcode ID: 56fe9c719d722c970fd035241d8cebfe96f5e80e6df5f50ea9c52f73bf5c4438
Instruction ID: 9009ebb5cbaa325b6e5202093cd807bb56351d9784dae783a0708a7a4f956e10
Opcode Fuzzy Hash: 56fe9c719d722c970fd035241d8cebfe96f5e80e6df5f50ea9c52f73bf5c4438
Instruction Fuzzy Hash: C7F0E99CDCA3A42DFF23D220981A7491A4117063D9F484459934CAB0CCDEE900D58752

Function 00ED099E Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 00ED09A4
__CxxThrowException@8.LIBCMT ref: 00ED09B2

Part of subcall function 00ED8E6B: RaiseException.KERNEL32(?,?,?,00F00F18,?,?,?,?,?,00ED5FC7,?,00F00F18,?,00000001), ref: 00ED8EC0

Part of subcall function 00ECA6CC: __EH_prolog3.LIBCMT ref: 00ECA6D3

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::exception::exception
String ID:
API String ID: 2977319401-0
Opcode ID: 409e3878552ef4b908215c09f0bd39721afa46db05ce85715582aac6e0b57baa
Instruction ID: 0673dad823f8622929b9d9eccbe424abbfd02e47845216b67136ea1c3968eaa2
Opcode Fuzzy Hash: 409e3878552ef4b908215c09f0bd39721afa46db05ce85715582aac6e0b57baa
Instruction Fuzzy Hash: A921E3716083849FC704EF64D956F6ABBE4FB84714F141A2EF452A73D1EB70A906CB42

Function 00ECB890 Relevance: 3.1, APIs: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,057A9A68), ref: 00ECB8DC

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

SetCurrentDirectoryA.KERNEL32(?,00000001,00000000,00EFD0E4,00000000,00000000), ref: 00ECB949

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CurrentDirectoryFileModuleName_memmove
String ID:
API String ID: 3206644969-0
Opcode ID: 30eccfb6bdbc40d7dbf145c327af20f32d9fc63ea993aac8ad53cdf12b37518c
Instruction ID: a8eed4c592c43dc0ee444bc328e0c2243aa69f1c56f8c9b252c52f9ee5b3f060
Opcode Fuzzy Hash: 30eccfb6bdbc40d7dbf145c327af20f32d9fc63ea993aac8ad53cdf12b37518c
Instruction Fuzzy Hash: CA21C1B1208380AFC720DB25DD56FABB7F8EBC4B10F000A1EB146A72C0DF75A505CA52

Function 00ED0D1D Relevance: 3.1, APIs: 2, Instructions: 58
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED0D27

Part of subcall function 00ED05B6: __EH_prolog3.LIBCMT ref: 00ED05BD

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

Part of subcall function 00ED0645: LoadLibraryA.KERNEL32(?), ref: 00ED065A

GetProcAddress.KERNEL32(?), ref: 00ED0DAF

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AddressH_prolog3H_prolog3_LibraryLoadProc_memmove
String ID:
API String ID: 3911338757-0
Opcode ID: f74b6073196cee3946da171380eb2cc9231d44bc198e9346d344afe1960759c7
Instruction ID: 8d69f20e6c7ccf083caf5e92b058deb465582d6880b3fa7e775453fcc179988e
Opcode Fuzzy Hash: f74b6073196cee3946da171380eb2cc9231d44bc198e9346d344afe1960759c7
Instruction Fuzzy Hash: 27119D70A013489ECB10EBA4CD51BEEBBB5EF55344F48109EE485BB382DA709E4ACB11

Function 00ED244C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fseek.LIBCMT ref: 00ED2437

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 93213c28a72f4a742df6807aea1c3ea7c95ce875294dfafdd51fda10e77addfc
Instruction ID: c451aafe5a7cffb1a67ee89475e6f9d45c33273656682ecbff22a1b988bf8271
Opcode Fuzzy Hash: 93213c28a72f4a742df6807aea1c3ea7c95ce875294dfafdd51fda10e77addfc
Instruction Fuzzy Hash: 19112C31A0021757DB361A189C017BA3685EF717A8F18703FFF65B5390E675CC139291

Function 00ED08E1 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00ED08E8

Part of subcall function 00ECC09E: __EH_prolog3.LIBCMT ref: 00ECC0A5

Part of subcall function 00ECA6CC: __EH_prolog3.LIBCMT ref: 00ECA6D3

Part of subcall function 00ECBE9C: TerminateProcess.KERNEL32(00000000,00000009), ref: 00ECBEBB
Part of subcall function 00ECBE9C: CloseHandle.KERNEL32(00000000), ref: 00ECBEC2

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3$CloseH_prolog3_catch_HandleProcessTerminate_memmove
String ID:
API String ID: 805874684-0
Opcode ID: adf6e86c7ce95e52534222235365496f5ed2c7e43ccdcc320b638986fd3269a8
Instruction ID: 2bfd18baaefdfd6d51dff9757ba35d47cbdb2c24ee291b3c47ff2dbfae144554
Opcode Fuzzy Hash: adf6e86c7ce95e52534222235365496f5ed2c7e43ccdcc320b638986fd3269a8
Instruction Fuzzy Hash: 9F118160A002448EEB10EFB8D562BDD77A0DF94308F58709EE1547B3D3CAA2490BC761

Function 00EC96D4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00EC96DB

Part of subcall function 00EC4375: __EH_prolog3.LIBCMT ref: 00EC437C

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 052a39f55f63b19f8aa626627b3abf786d6f1ffe450e8661830d38ed330dd05b
Instruction ID: c7db2fc1fc23c883b46d1ed02eb0090270a4a77556fed55859328bb41ef1a1a0
Opcode Fuzzy Hash: 052a39f55f63b19f8aa626627b3abf786d6f1ffe450e8661830d38ed330dd05b
Instruction Fuzzy Hash: 07112BB06002089FD714DF68CA85A6AB7E5FF84308B14555DE485AB352D7B2ED42CB51

Function 00ECA203 Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00ECA20A

Part of subcall function 00ECABFD: __EH_prolog3.LIBCMT ref: 00ECAC04
Part of subcall function 00ECABFD: std::_Lockit::_Lockit.LIBCPMT ref: 00ECAC0E
Part of subcall function 00ECABFD: int.LIBCPMT ref: 00ECAC25
Part of subcall function 00ECABFD: std::locale::_Getfacet.LIBCPMT ref: 00ECAC2E

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3$GetfacetLockitLockit::_std::_std::locale::_
String ID:
API String ID: 326493665-0
Opcode ID: e58a6947c1471a7d7702a105d66fe70951cacad628782ef2199e2eb2d3d11686
Instruction ID: 038842a126de644f59abe571b88f810a3cf3c98f663b229ebab8f3b1e44021e9
Opcode Fuzzy Hash: e58a6947c1471a7d7702a105d66fe70951cacad628782ef2199e2eb2d3d11686
Instruction Fuzzy Hash: E7F030706001286BDB18B6648E06F5E2395AB50718F08603DB915BA292EFB799468652

Function 00ED0645 Relevance: 1.5, APIs: 1, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00ED065A

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 560f14c2c995ecd2caa85a51e4cae238619141f6a68b9bf9eb86c887571ed1ba
Instruction ID: b5a11ed3e182967b80d774bb3b48aa11ffe258529e2e8c53dce62f43b250314c
Opcode Fuzzy Hash: 560f14c2c995ecd2caa85a51e4cae238619141f6a68b9bf9eb86c887571ed1ba
Instruction Fuzzy Hash: DFF03A71511218EF9714CF99D848DDABBBCEA4920175406ABE416D7601D771EE44CBA0

Function 028AD434 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(028A0000,?,00000105), ref: 028AD452

Part of subcall function 028AE6E8: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,028AE7A4,?,028A0000,02BABC30), ref: 028AE724
Part of subcall function 028AE6E8: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,028AE7A4,?,028A0000,02BABC30), ref: 028AE775

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction ID: fdb8bf5b9f66b0bc2809e2c6f7ab62aed886337f9af7ea77042a0e609ebf00e4
Opcode Fuzzy Hash: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction Fuzzy Hash: 75E06D79A013108FEB14DE5CC8C0B4633D4AB08710F044961ED58CF34AE770D9108BD1

Function 00ED2455 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00ED2468

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: ef0ff64c7a632e6245a0dc59d1d7025ee5eb7651181f3867215440a9f84d4f9b
Instruction ID: 1c2b0f05984254d341dac442aa1acf79563ae8098d15f6b5001f16acff84d419
Opcode Fuzzy Hash: ef0ff64c7a632e6245a0dc59d1d7025ee5eb7651181f3867215440a9f84d4f9b
Instruction Fuzzy Hash: 50C04C7645420CAFCF016FC9FC018597BA9AB48714B049025F91C15232D673E675DB85

Function 028A5644 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 028A565B

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 200e4b01dce34d6f88fc69a32dec5bff50dbdee3d66c1fa53e81ee76a0267696
Instruction ID: 75e39b3256af9929b5093829e5bd1f8d0437e042aa1165b81e935316f96b2cf0
Opcode Fuzzy Hash: 200e4b01dce34d6f88fc69a32dec5bff50dbdee3d66c1fa53e81ee76a0267696
Instruction Fuzzy Hash: 7AF0A4F2F812015BE7199F7C9A40742BBD9A709391F21457EE918DB784DAB548808790

Non-executed Functions

Function 028ADDBC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 028ADDD9
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 028ADDEA
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 028ADEF8
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 028ADF0A
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 028ADF16
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 028ADF5B

Strings

kernel32.dll, xrefs: 028ADDD4
GetLongPathNameW, xrefs: 028ADDE4
\, xrefs: 028ADF28

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 1e560c3f386513c6931c667f29eda16d347486fbc1d03880af59f1c1c5fb058b
Instruction ID: 47e48a734b6b7e0b8f61f94d986cafab9d24cbb16875d39a68b498f0cb09214d
Opcode Fuzzy Hash: 1e560c3f386513c6931c667f29eda16d347486fbc1d03880af59f1c1c5fb058b
Instruction Fuzzy Hash: 9051903DE006089BEB10EBA8CC94BDEB3B6AF44310F5485A4D549E7A50EF74AE45CF42

Function 00ECBD43 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125processCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECBD4D
SetErrorMode.KERNEL32(00000003,000000A8,00ED07ED,?,00000001,00000000,00000001,00000000,00000000,057A9A68,00000000), ref: 00ECBDC5
__set_abort_behavior.LIBCMT ref: 00ECBDCE
_memset.LIBCMT ref: 00ECBDEC
CreateProcessAsUserA.ADVAPI32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?,?,/restart --ppapi-flash-path=./pepflashplayer.dll,057A9A68), ref: 00ECBE39

Part of subcall function 00ECC032: __EH_prolog3.LIBCMT ref: 00ECC039

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?,?,/restart --ppapi-flash-path=./pepflashplayer.dll,057A9A68), ref: 00ECBE72

Strings

D, xrefs: 00ECBDF4

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CreateProcess$ErrorH_prolog3H_prolog3_ModeUser__set_abort_behavior_memmove_memset
String ID: D
API String ID: 2062113284-2746444292
Opcode ID: 859649649149a62b13f18573c4d7b4785c6a38af190d855b5126b91fb9a4f238
Instruction ID: 84217d8424a891a3d3f496b416e9e274dd248e0b691fbaa47ebab7e877eba86a
Opcode Fuzzy Hash: 859649649149a62b13f18573c4d7b4785c6a38af190d855b5126b91fb9a4f238
Instruction Fuzzy Hash: 344192719003089FDB14DBA4CA92FEEB7B9EF44704F60951DE11277181DB72AA4ACB61

Function 00EEF1DD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00EEF1F4
_wcscmp.LIBCMT ref: 00EEF205
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00EEF4A3,?,00000000), ref: 00EEF221
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00EEF4A3,?,00000000), ref: 00EEF24B

Strings

ACP, xrefs: 00EEF1EE
OCP, xrefs: 00EEF1FF

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: cf9c1deea017b90da7d35ed932a20153f0150c98fdc995f8006d6d66683c26c5
Instruction ID: 8faf2548fac21f68783db14c0db3119375e8e5664851e31da4f80daf9f9e9a11
Opcode Fuzzy Hash: cf9c1deea017b90da7d35ed932a20153f0150c98fdc995f8006d6d66683c26c5
Instruction Fuzzy Hash: E301843920154EABDB109E56EC45FE677D8AB18759B109035FB08FA1A1EB30D981D790

Function 00ECBED0 Relevance: 9.1, APIs: 6, Instructions: 70processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ECBEEC
Process32First.KERNEL32(00000000,?), ref: 00ECBF11
GetCurrentProcessId.KERNEL32 ref: 00ECBF1B
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00ECBF5A
Process32Next.KERNEL32(00000000,00000128), ref: 00ECBF70
CloseHandle.KERNEL32(00000000), ref: 00ECBF85

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ProcessProcess32$CloseCreateCurrentFirstHandleNextOpenSnapshotToolhelp32
String ID:
API String ID: 3382086244-0
Opcode ID: 91effce3b8f63796c1373a20d6ea41db9472beb1f30c7f78ab7353711ad8af93
Instruction ID: ae08ece342e8709ed96800f5c1c7b12f0184870cfc1d7de38e341e8f2e83d1de
Opcode Fuzzy Hash: 91effce3b8f63796c1373a20d6ea41db9472beb1f30c7f78ab7353711ad8af93
Instruction Fuzzy Hash: CE21AF317012589FDB309F659D8AFBE77B8EB49715F1011AEE805E2280DB329E46CF61

Function 028AD958 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,028ADABF,?,?,?,00000000), ref: 028ADA02
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,028ADABF,?,?,?,00000000), ref: 028ADA1E
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,028ADABF,?,?,?,00000000), ref: 028ADA2F

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 91d198e581038ec00e0779d7e2921f154416174af42cfcbf535c1fe8a1e5578b
Instruction ID: 60858c628ccf392444156c0d0aafb25f8029046fa810ccaee458cbdcb1dcdbdb
Opcode Fuzzy Hash: 91d198e581038ec00e0779d7e2921f154416174af42cfcbf535c1fe8a1e5578b
Instruction Fuzzy Hash: 9F31AE3C90460CAAFB20DB58DCA1BDEB7BAFB48701F0405A6D509E7644DF75AE90CE51

Function 028AE4F4 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,028AE5B6,?,?), ref: 028AE526
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,028AE5B6,?,?), ref: 028AE52F

Part of subcall function 028AE3A0: FindFirstFileW.KERNEL32(00000000,?,00000000,028AE400,?,?), ref: 028AE3D3
Part of subcall function 028AE3A0: FindClose.KERNEL32(00000000,00000000,?,00000000,028AE400,?,?), ref: 028AE3E3

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 072423bc4ca5728437b849440c3d5aff229d9480d86c79168d1b440b8b0d82a0
Instruction ID: 9561ccd43750099e0d1f311993c7758b4819486ea3d5c372a81438c8cd9fe012
Opcode Fuzzy Hash: 072423bc4ca5728437b849440c3d5aff229d9480d86c79168d1b440b8b0d82a0
Instruction Fuzzy Hash: 9811637CA042099FFB04EFA8D9A1AADB3BAEF44300F504875E505E7640EF746E04CE62

Function 028AE3A0 Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,028AE400,?,?), ref: 028AE3D3
FindClose.KERNEL32(00000000,00000000,?,00000000,028AE400,?,?), ref: 028AE3E3

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b279fa379bfbd53290e1c56da624c45205035a941cef88cedfa3dbc07c4033fe
Instruction ID: de105abd342874762431022ee2c9fdc075460d28f911752c915640aba388293d
Opcode Fuzzy Hash: b279fa379bfbd53290e1c56da624c45205035a941cef88cedfa3dbc07c4033fe
Instruction Fuzzy Hash: D5F0BE7D944608AFF710EBB8DC7589EB7ACDB083207600DB1E404E2650EE38AA409951

Function 00EDB285 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00ED6706,?,?,?,00000001), ref: 00EDB28A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00EDB293

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f048ab51385302456dec2d384dca1e5217c1f1febde1dd010ccf419da2dc82a4
Instruction ID: 6642dce5969cbd38cf0bf20dec06dd1dc1b544c8cf66adbc012d4ebb54c2ff05
Opcode Fuzzy Hash: f048ab51385302456dec2d384dca1e5217c1f1febde1dd010ccf419da2dc82a4
Instruction Fuzzy Hash: FCB09231044208AFCB202F92EC09BA83F28EB84662F100010F60E54160CF625458DA95

Function 00EDCC28 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00EDCC14,00000001,?,00EEE6B8,00EEE756,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00EDCC56

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 31a2f9b136aad9a9c5beedc4c649e8099de97eb25d83714c707d740704a3a0c1
Instruction ID: d31ba24cb34a6acbbae01b7f7bc06e55c55fbc591925aa2f3b2cc4972929234e
Opcode Fuzzy Hash: 31a2f9b136aad9a9c5beedc4c649e8099de97eb25d83714c707d740704a3a0c1
Instruction Fuzzy Hash: DAE0B67215430DEFDF11CF94EC45B697BA5FB48B65F104401B60C9A1A0C6B2A5A1EF54

Function 00EDCC65 Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,?,00EE21B3,?,00EE21B3,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00EDCC8C

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2d89891beb4471cd6fd8758a597d213cfabebb84acf4ab48755b306bb4fcd795
Instruction ID: a24bc5a52eed66457156fed5354dfd8b39c72f704ad18901b6a81d5d872e13d4
Opcode Fuzzy Hash: 2d89891beb4471cd6fd8758a597d213cfabebb84acf4ab48755b306bb4fcd795
Instruction Fuzzy Hash: 62D0677600410DBFDF019FE1EC05C6A7BADFB88358B544806FA1D95121DA72A520EB61

Function 028AFFCC Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 028AFFCC

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a94b68114202ab79540736e63771c4cdb77682aed9b838516ddd5b130eb4b0c1
Instruction ID: e8e996bdd898435fe1f6d79076c699e2b03c637c86b183685b5482cbde5bcb72
Opcode Fuzzy Hash: a94b68114202ab79540736e63771c4cdb77682aed9b838516ddd5b130eb4b0c1
Instruction Fuzzy Hash: 07D09E7DD5154345EA204614C96136C6291E393788FD58562C356C6D85DEBD8081AE01

Function 00EDB254 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00EDB25A

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b265b961b6d63736c32d24a424c95618c5bb6702b7ed273ded65ff3323ff3c60
Instruction ID: 8a4d52b08b3209bd3853d513c33a314df0810be10fe5e48aaf4c7ed7306c4b62
Opcode Fuzzy Hash: b265b961b6d63736c32d24a424c95618c5bb6702b7ed273ded65ff3323ff3c60
Instruction Fuzzy Hash: EBA0113000020CABCB202B82EC088A83F2CEB802A0B000020F80E00020CF22A820AA88

Function 028AFFB8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 028AFFBC

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e4769fb9a30394e4fb921cd52a4d055e26974a52fbee28e17ccedf3d44f67a8e
Instruction ID: aa1c55c9ef8beee8bc7a064332699a616b214b0936302d501af6a030dff2d6b3
Opcode Fuzzy Hash: e4769fb9a30394e4fb921cd52a4d055e26974a52fbee28e17ccedf3d44f67a8e
Instruction Fuzzy Hash: 79A01218C084000AC404E71C4C4250F31801986514FC80210645CD5292EA0985A406DB

Function 00EDD605 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00ED4F0B,00F00FE8,00000014), ref: 00EDD605

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b81164dd55f7dad239bdc320620cfe7ba703d06c90551b6601a5828b995d5a14
Instruction ID: a55fbb7b6cc4b8885adfce29eebdc39a81df22d34abd0aed252f89bfba0cbfb1
Opcode Fuzzy Hash: b81164dd55f7dad239bdc320620cfe7ba703d06c90551b6601a5828b995d5a14
Instruction Fuzzy Hash: 5BB012F03035068B87080B397C5911A35E87748211344403D7007D1160DF20C854EE00

Function 00EDC0B4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: a8df0c322183215c1814fc70069208b9003e17da98b3fa8fb62c1290d06637c0
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 1EC1B6322150938ADF2D4639843443EFAA1EA927F932A275FD4B3DB6D5FF20C526D610

Function 00EDC4E9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: a3078ecb8a9a66fc879ea81b889afd8100b950759c96e351167210bde63a6411
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: EDC1853221509389DF2D4639C43443EFAA1AE927F932A276FD4B2DB6D4FF20D526D520

Function 00EDBC7F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 82468e09b85533e823f6c042c1fd628a1568c994a1390d244e8c01db3f8fa5ff
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 92C1B33221519389DF2D463A843447EFBA1EAA17B931B276FD4B2DB2D4FF10C526D610

Function 00EDB867 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0828ecc7aee93342899d58dd25b9f3b8774e67823f5fea7b7078c0346c4ee460
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 23C1933221509389DF2D463A847443EFAA1EAA17B931B275FD4B3DB6D4FF10C526D620

Function 00ED5A90 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 14d3dcb9716d737c67f7ae3093f8d755c377db994638a75395576cc0c2f2f43c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EC113D7730086247D604CA3DC8F86BBA795EBD6328B3DB37BD0416B754E522D947DA00

Function 028AC3B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: 8bf79ec112fa48068f77cab37aefb4b2319b0765f55cc5e588ea3859e7e685cc
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: 0701D632B053110B970CDD3ECD9862AB6D3ABC8910F09C63E9589C72C8DD318C1AC286

Function 028A7048 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 80memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 028A7065
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 028A706B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A707E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A708B
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A709F
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 028A70A5
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A70C3
GetProcessHeap.KERNEL32(00000000,?,028A7127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A7112
HeapFree.KERNEL32(00000000,00000000,?,028A7127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A7118

Strings

+!, xrefs: 028A70B0
GetLogicalProcessorInformation, xrefs: 028A705B
kernel32.dll, xrefs: 028A7060

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Heap$InformationLogicalProcessProcessor$AddressAllocateErrorFreeHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll$+!
API String ID: 3837757292-3207784131
Opcode ID: 1a10a9fd6b81ff09ebf18776fbe4cc4d4e3a85a8b527e735b26d812a36942d84
Instruction ID: d03d3dcd61a59ed7ae95d1354703de20b3931f1cb793a376b5eb28d9b872e4ad
Opcode Fuzzy Hash: 1a10a9fd6b81ff09ebf18776fbe4cc4d4e3a85a8b527e735b26d812a36942d84
Instruction Fuzzy Hash: BB21A47DE04208AFFB10DBA8C861B5EF3FAEB44310F5484A1E508D7241EFB896809F51

Function 00ECB1DD Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 343COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ECB2A2
_memmove.LIBCMT ref: 00ECB2D4
_memmove.LIBCMT ref: 00ECB309
_memmove.LIBCMT ref: 00ECB391
_memmove.LIBCMT ref: 00ECB408
_memmove.LIBCMT ref: 00ECB473
_memmove.LIBCMT ref: 00ECB4B7
_memmove.LIBCMT ref: 00ECB4F4

Strings

invalid string position, xrefs: 00ECB526
string too long, xrefs: 00ECB51C

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 05f1ca4870d1ca3e43e4c3a7f94301feeaa58c70ef6ab9a7e9487c2bfafd55c8
Instruction ID: f5bf76e4a0795418b40cff2e4761a76f230dc5b271fb6a7ad72f8b071621ba78
Opcode Fuzzy Hash: 05f1ca4870d1ca3e43e4c3a7f94301feeaa58c70ef6ab9a7e9487c2bfafd55c8
Instruction Fuzzy Hash: 3DD14B71A00649DBCB24CF48DA82E9AB7F5FF48740F24592DE951E7302D732E9528BA4

Function 00ECC0D9 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ECC0E0
GetCommandLineA.KERNEL32(00000008,00ECC0CE,00000004,00ED0ADE,057A9A68), ref: 00ECC115

Part of subcall function 00ECC233: GlobalAlloc.KERNEL32(00000000,?), ref: 00ECC260

___from_strstr_to_strchr.LIBCMT ref: 00ECC156

Strings

source, xrefs: 00ECC181
recove, xrefs: 00ECC206
startup, xrefs: 00ECC1B4
install, xrefs: 00ECC19D
subsource, xrefs: 00ECC1E2
restart, xrefs: 00ECC1CB

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocCommandGlobalH_prolog3Line___from_strstr_to_strchr
String ID: install$recove$restart$source$startup$subsource
API String ID: 1890388871-97243790
Opcode ID: 6eecb916f20deaf4ae4e1bf879243b201b14317dad4b201338f53a9476d6b680
Instruction ID: f7c88b3b2fcb1edfe6e77346ee2acfd2d97eebec56289383c34929fc6fed5eca
Opcode Fuzzy Hash: 6eecb916f20deaf4ae4e1bf879243b201b14317dad4b201338f53a9476d6b680
Instruction Fuzzy Hash: AF41277110CB424AD3295B65AA81F3B6BF1BB51728F34344EF48A76A93EFA6A4434341

Function 00ECABFD Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ECAC04
std::_Lockit::_Lockit.LIBCPMT ref: 00ECAC0E

Part of subcall function 00ED1547: __lock.LIBCMT ref: 00ED1558

int.LIBCPMT ref: 00ECAC25

Part of subcall function 00EC149E: std::_Lockit::_Lockit.LIBCPMT ref: 00EC14AF

std::locale::_Getfacet.LIBCPMT ref: 00ECAC2E
codecvt.LIBCPMT ref: 00ECAC48
std::bad_exception::bad_exception.LIBCMT ref: 00ECAC5C
__CxxThrowException@8.LIBCMT ref: 00ECAC6A
std::_Facet_Register.LIBCPMT ref: 00ECAC80

Strings

bad cast, xrefs: 00ECAC54

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockcodecvtstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1757418035-3145022300
Opcode ID: f7224e29ca43790882b0dcad00d9ec0d764ffe7b0d47bb5e76fbe635323d0389
Instruction ID: 6cb84465e7ee7702c50c4d85cce6d1a3d744efd7a442fb2e8ccb7dae76c73bd9
Opcode Fuzzy Hash: f7224e29ca43790882b0dcad00d9ec0d764ffe7b0d47bb5e76fbe635323d0389
Instruction Fuzzy Hash: C901C03290021D9BCB10EBA4CA02EFE73B4BF84314F15251AF901BB2D1DF3699029B91

Function 00EC7B39 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC7B40
std::_Lockit::_Lockit.LIBCPMT ref: 00EC7B4A

Part of subcall function 00ED1547: __lock.LIBCMT ref: 00ED1558

int.LIBCPMT ref: 00EC7B61

Part of subcall function 00EC149E: std::_Lockit::_Lockit.LIBCPMT ref: 00EC14AF

std::locale::_Getfacet.LIBCPMT ref: 00EC7B6A
ctype.LIBCPMT ref: 00EC7B84
std::bad_exception::bad_exception.LIBCMT ref: 00EC7B98
__CxxThrowException@8.LIBCMT ref: 00EC7BA6
std::_Facet_Register.LIBCPMT ref: 00EC7BBC

Strings

bad cast, xrefs: 00EC7B90

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockctypestd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 2017145326-3145022300
Opcode ID: 7038762294ab1569dda475d76b1e06b42e4c06fce7e127482afcb3cace9f7dfd
Instruction ID: b82e7e1886e54cf55eddd36f7e5d70b008d088bd042ebfaa53759ab37061d677
Opcode Fuzzy Hash: 7038762294ab1569dda475d76b1e06b42e4c06fce7e127482afcb3cace9f7dfd
Instruction Fuzzy Hash: E7016D329005299BCF10EBA4CA52EEE73A5BF84710F10645AF511BB3D2DF769D029B91

Function 028A8610 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 028A8625
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 028A862B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A863E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A864B
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,028A86C4,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 028A8676

Strings

kernel32.dll, xrefs: 028A8620
GetLogicalProcessorInformation, xrefs: 028A861B
@, xrefs: 028A86CB

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9468f08d31798f1ae05f34b6489eae0d941eaca40ac4b293d1ab7596ae05db05
Instruction ID: 76362fa5e2fb90de1b91dcabda8529ad7def4233e6c2af15c6737519949839eb
Opcode Fuzzy Hash: 9468f08d31798f1ae05f34b6489eae0d941eaca40ac4b293d1ab7596ae05db05
Instruction Fuzzy Hash: B911AFBDD04208AEFB10EBADCD68B5EB7B9EB44304F148491D518D3252DF788A80CF61

Function 00EC7DDD Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC7DE4
std::_Lockit::_Lockit.LIBCPMT ref: 00EC7DEE

Part of subcall function 00ED1547: __lock.LIBCMT ref: 00ED1558

int.LIBCPMT ref: 00EC7E05

Part of subcall function 00EC149E: std::_Lockit::_Lockit.LIBCPMT ref: 00EC14AF

std::locale::_Getfacet.LIBCPMT ref: 00EC7E0E
std::bad_exception::bad_exception.LIBCMT ref: 00EC7E3C
__CxxThrowException@8.LIBCMT ref: 00EC7E4A
std::_Facet_Register.LIBCPMT ref: 00EC7E60

Strings

bad cast, xrefs: 00EC7E34

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1501143699-3145022300
Opcode ID: da0527e9a34ce8dad9b2b07cb2f801a5414ca998dbef927b9a82807d9b0ffc58
Instruction ID: 9803b00f483e5727e97b6f6898bd976ddc74d6567e3a7bca5ac68dacb0a1492e
Opcode Fuzzy Hash: da0527e9a34ce8dad9b2b07cb2f801a5414ca998dbef927b9a82807d9b0ffc58
Instruction Fuzzy Hash: BE01A1329106199FCB15EBA0DA02EAD73A4BF80710F20244DF511BB3D1CF35AD029B90

Function 00EC7D44 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC7D4B
std::_Lockit::_Lockit.LIBCPMT ref: 00EC7D55

Part of subcall function 00ED1547: __lock.LIBCMT ref: 00ED1558

int.LIBCPMT ref: 00EC7D6C

Part of subcall function 00EC149E: std::_Lockit::_Lockit.LIBCPMT ref: 00EC14AF

std::locale::_Getfacet.LIBCPMT ref: 00EC7D75
std::bad_exception::bad_exception.LIBCMT ref: 00EC7DA3
__CxxThrowException@8.LIBCMT ref: 00EC7DB1
std::_Facet_Register.LIBCPMT ref: 00EC7DC7

Strings

bad cast, xrefs: 00EC7D9B

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1501143699-3145022300
Opcode ID: c4ed7636c5c878db2b8d06d48a55cb59e5b72093a2f5e83b67c2c4957b9cdc06
Instruction ID: 0a340484c466db5457ee82b80e0d1f917aa7e58d81f7bb21fa8a81d5c051f41a
Opcode Fuzzy Hash: c4ed7636c5c878db2b8d06d48a55cb59e5b72093a2f5e83b67c2c4957b9cdc06
Instruction Fuzzy Hash: 700161329106199BCB10EB64CE02EBD77E4FF85710F111559F512BB2D2DF3599029B91

Function 00EC7E76 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC7E7D
std::_Lockit::_Lockit.LIBCPMT ref: 00EC7E87

Part of subcall function 00ED1547: __lock.LIBCMT ref: 00ED1558

int.LIBCPMT ref: 00EC7E9E

Part of subcall function 00EC149E: std::_Lockit::_Lockit.LIBCPMT ref: 00EC14AF

std::locale::_Getfacet.LIBCPMT ref: 00EC7EA7
std::bad_exception::bad_exception.LIBCMT ref: 00EC7ED5
__CxxThrowException@8.LIBCMT ref: 00EC7EE3
std::_Facet_Register.LIBCPMT ref: 00EC7EF9

Strings

bad cast, xrefs: 00EC7ECD

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1501143699-3145022300
Opcode ID: c9182849ffe67259772ec486ea2a4c7cb8144c4d3a1032e44de53cd240491daa
Instruction ID: 02f6519a2ceae92bbd76bc17f21273b98a4c740fbe70818288041f2fe3953504
Opcode Fuzzy Hash: c9182849ffe67259772ec486ea2a4c7cb8144c4d3a1032e44de53cd240491daa
Instruction Fuzzy Hash: D7015B36A106199BCB14EBA4CA02EAE73A4BF84710F10255AF511BB291DF35AD029B91

Function 00EC1CBA Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00EC1CCA
swprintf.LIBCMT ref: 00EC1CE6
GetModuleHandleA.KERNEL32(C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe), ref: 00EC1CEF
LoadLibraryA.KERNEL32(C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe), ref: 00EC1CFC
GetModuleFileNameA.KERNEL32(00EC0000,C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe,00000104), ref: 00EC1D16

Strings

%s.dll, xrefs: 00EC1CD8
C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe, xrefs: 00EC1CE5, 00EC1CEE, 00EC1CFB, 00EC1D12
EXE, xrefs: 00EC1CBE, 00EC1CC5, 00EC1CC6, 00EC1CD7

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Module$FileHandleLibraryLoadName_memcmpswprintf
String ID: %s.dll$C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe$EXE
API String ID: 3769968506-2916543443
Opcode ID: 56fe44ef40559b3fd30e29ebf208020b4268affb5650ec4efb5a472f1957d5ba
Instruction ID: 980065d63e0a9d8532b89a36691427f1784414fbe9a71c74d23ce64b9ccdac1c
Opcode Fuzzy Hash: 56fe44ef40559b3fd30e29ebf208020b4268affb5650ec4efb5a472f1957d5ba
Instruction Fuzzy Hash: 3AF090F2200305ABE3305B259D86FB77AECDB9571AF20082DFA95F1241EB759806C664

Function 028B0975 Relevance: 13.8, APIs: 9, Instructions: 257COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 028B0A2C

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2db09f060fc4f4711609c38058dd8b0957f4192af5fd9ac019ba53b9e81d8f84
Instruction ID: fd97069c35ed11679c70833c2ee07aabd5429bf38a17b17f9bb20488a48b08fa
Opcode Fuzzy Hash: 2db09f060fc4f4711609c38058dd8b0957f4192af5fd9ac019ba53b9e81d8f84
Instruction Fuzzy Hash: FCA139BDD002099BDB26DFA8D880BEEB7B5AF48314F14852DE519E7380EB70A945CB51

Function 00EC6426 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 497COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EC642D
_Find_elem.LIBCPMT ref: 00EC65C7

Part of subcall function 00EC74A7: __EH_prolog3_GS.LIBCMT ref: 00EC74AE

Strings

0123456789-+Ee, xrefs: 00EC64DC

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_$Find_elem
String ID: 0123456789-+Ee
API String ID: 3792878951-1347306980
Opcode ID: dc5d5db527742af8fd246b2d7ef521b29452a497fca3b4ac568dc9dac4e3c56a
Instruction ID: bd0142dfdb46b7bbc504783e01c5869a693399089546695c9f36a09dbaf5b2cb
Opcode Fuzzy Hash: dc5d5db527742af8fd246b2d7ef521b29452a497fca3b4ac568dc9dac4e3c56a
Instruction Fuzzy Hash: 2202C160E082889EDF159BA48350FFEBBF6AF55308F18605DE4957B242CB769C47CB21

Function 00ECE335 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ECE3A3
__CxxThrowException@8.LIBCMT ref: 00ECE3B8

Strings

false, xrefs: 00ECE37D
pp, xrefs: 00ECE44C
pp, xrefs: 00ECE476
true, xrefs: 00ECE378, 00ECE385
pp, xrefs: 00ECE41F

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: false$pp$pp$pp$true
API String ID: 3728558374-2998651751
Opcode ID: b759fd4456d9498431b582921d21a646118118bbbb89a7a2d81f2561413e354c
Instruction ID: d67f09fb385f367dc4ccc8f7441a0de177ee5b4220c99a3f82f1ee80575f1751
Opcode Fuzzy Hash: b759fd4456d9498431b582921d21a646118118bbbb89a7a2d81f2561413e354c
Instruction Fuzzy Hash: 9701967050028CA6DB20D61CCF47B7E7AA4AB40308F24641DE904FB341D772E942D691

Function 028ADC74 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02BBCC18), ref: 028ADC92
RtlLeaveCriticalSection.NTDLL(02BBCC18), ref: 028ADCB6
RtlLeaveCriticalSection.NTDLL(02BBCC18), ref: 028ADCC5
IsValidLocale.KERNEL32(00000000,00000002,00000000,028ADD7A,?,?,?,00000000,?,028AE67A,00000000,028AE6DB,?,?,00000000,00000000), ref: 028ADCD7
RtlEnterCriticalSection.NTDLL(02BBCC18), ref: 028ADD34
RtlLeaveCriticalSection.NTDLL(02BBCC18), ref: 028ADD5D

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID:
API String ID: 975949045-0
Opcode ID: ad930b1019c20ec2823043bdccb67edbe43beae241bb09d9c1cc5f95ea254832
Instruction ID: 11fc78d8320a35cbaf716454d80abbe14fa4a0601f1a133f7162dc84ecdb40e2
Opcode Fuzzy Hash: ad930b1019c20ec2823043bdccb67edbe43beae241bb09d9c1cc5f95ea254832
Instruction Fuzzy Hash: 0B21D83CB442085BFB12F67D98307AD36969F85741F905462A002D7E61CEF8AD80CEE7

Function 028A5EE3 Relevance: 10.9, APIs: 7, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0889d83d3ead169cc9558a5966e634dcdbc2d510843777ae603d54c53e88bb
Instruction ID: 9cfdcdaed0296270825072263e14a2b04c5afb5f77e051a3e79e3edfb73ff2a0
Opcode Fuzzy Hash: 3c0889d83d3ead169cc9558a5966e634dcdbc2d510843777ae603d54c53e88bb
Instruction Fuzzy Hash: 9FB107AEF006141BF7159A7CDCA476EB786DBC4325F5C823DE219CB289EF6888858351

Function 00ECD9FD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ECDA90
_memmove.LIBCMT ref: 00ECDABD
_memmove.LIBCMT ref: 00ECDAF3
_memmove.LIBCMT ref: 00ECDB0C
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00ECDB47

Strings

deque<T> too long, xrefs: 00ECDB4C

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove$Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID: deque<T> too long
API String ID: 279611364-309773918
Opcode ID: 8798f7ef200ada54e1e30141b478e5fc2f6f4f1a7b6aec2a53700e1473caa1c1
Instruction ID: 4ad4503a5b1fe235680c78c570a511495ddfbd25df03f6422bc02cd698caef01
Opcode Fuzzy Hash: 8798f7ef200ada54e1e30141b478e5fc2f6f4f1a7b6aec2a53700e1473caa1c1
Instruction Fuzzy Hash: B941E277A00615ABDB14DE68DE81AAAB7F5EF40320715463DEC25F3780D772ED06CA90

Function 00ECD88B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ECD91B
_memmove.LIBCMT ref: 00ECD948
_memmove.LIBCMT ref: 00ECD97E
_memmove.LIBCMT ref: 00ECD997
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00ECD9D2

Strings

deque<T> too long, xrefs: 00ECD9D7

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove$Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID: deque<T> too long
API String ID: 279611364-309773918
Opcode ID: c01f3d303006539ef517d2542cdc5631bc89b03c05456077781b56f74cadee91
Instruction ID: ed2a20569dd16dfd9c4c7001bd0a9c8722b5cecb1806fad586a849c3c66bb6d5
Opcode Fuzzy Hash: c01f3d303006539ef517d2542cdc5631bc89b03c05456077781b56f74cadee91
Instruction Fuzzy Hash: 5241F577A00615ABDB149E69DD80AAAB7B5EF80320714463DEC24F3780D772EE168690

Function 028A8880 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 028A8D40: GetCurrentThreadId.KERNEL32 ref: 028A8D43

GetTickCount.KERNEL32 ref: 028A88B7
GetTickCount.KERNEL32 ref: 028A88CF
GetCurrentThreadId.KERNEL32 ref: 028A88FE
GetTickCount.KERNEL32 ref: 028A8929
GetTickCount.KERNEL32 ref: 028A8960
GetTickCount.KERNEL32 ref: 028A898A
GetCurrentThreadId.KERNEL32 ref: 028A89FA

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 33c8b8feeb33e73e78edda30a77980173b7eacf95b10882f7ce6c71fb047442b
Instruction ID: f03b6bddc2e97cba60426b41c0b44ac54113b79a6b2a45c15b5f9db769358b56
Opcode Fuzzy Hash: 33c8b8feeb33e73e78edda30a77980173b7eacf95b10882f7ce6c71fb047442b
Instruction Fuzzy Hash: 3A416F3D6083859EF7219E7CC49432EBAD1AF84359F18892DD4D8C7281EF749480CB63

Function 00EDD1BF Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00EDD1BF

Part of subcall function 00EDD420: EncodePointer.KERNEL32(00000000,?,00EDD1C4,00ED4F1C,00F00FE8,00000014), ref: 00EDD423
Part of subcall function 00EDD420: __initp_misc_winsig.LIBCMT ref: 00EDD43E

__mtinitlocks.LIBCMT ref: 00EDD1C4
__mtterm.LIBCMT ref: 00EDD1CD
__calloc_crt.LIBCMT ref: 00EDD1F2
__initptd.LIBCMT ref: 00EDD214
GetCurrentThreadId.KERNEL32 ref: 00EDD21B

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CurrentEncodePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1469070506-0
Opcode ID: 9583856fc505cee293481dcad23ebda62a40b6700ea7257ce291eafd72bcff98
Instruction ID: b5005557f3f10372219144670e1048e962e8f2fca331c21ee47daa880beba8a5
Opcode Fuzzy Hash: 9583856fc505cee293481dcad23ebda62a40b6700ea7257ce291eafd72bcff98
Instruction Fuzzy Hash: 67F09A7261D3212EE6347B74BC0765B3AC9DF01774B20362BF968F42E2EE20D843A191

Function 028A99A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,028A9A58,?,02BBCBD0,02BBCBD0), ref: 028A99D9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,028A9A58,?,02BBCBD0,02BBCBD0), ref: 028A99DF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,028A9A58,?,02BBCBD0,02BBCBD0), ref: 028A99FA
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,028A9A58,?,02BBCBD0), ref: 028A9A00

Strings

Error, xrefs: 028A9A12
Runtime error at 00000000, xrefs: 028A99D2, 028A9A17

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 5a5efce27cb3f7337bc286c6ddf32b4fba4ac633e716fba115f115e0112b1314
Instruction ID: d6e65e4b24d0d37e1a3244822b50a69ceacd80d7958104574119ecb8bc6b1f45
Opcode Fuzzy Hash: 5a5efce27cb3f7337bc286c6ddf32b4fba4ac633e716fba115f115e0112b1314
Instruction Fuzzy Hash: 77F0C2ADE8C34079F61162589C26F5A364CA744F14F484946F224D90C2CFE844C48B22

Function 028A6230 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 028A6252
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 028A6258
GetStdHandle.KERNEL32(000000F4,028A551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 028A6277
WriteFile.KERNEL32(00000000,000000F4,028A551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 028A627D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,028A551C,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 028A6294
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,028A551C,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 028A629A

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 1aa4e6b86424f17bd7e72bfe392914dfe38cde305ff76485c7c3d7b8ce049b2f
Instruction ID: f290ae6931dce2bec1ba6702b7b6f95f9ae3f8162c040585859bb1041cad9daa
Opcode Fuzzy Hash: 1aa4e6b86424f17bd7e72bfe392914dfe38cde305ff76485c7c3d7b8ce049b2f
Instruction Fuzzy Hash: 0401A4ADA842103EF510F2AC8C95F7F3B8D9B58765F804611B228F20C2DD588D80CB73

Function 028A5964 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,028A5931), ref: 028A5A1B
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,028A5931), ref: 028A5A31
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,028A5931), ref: 028A5A5F
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,028A5931), ref: 028A5A75

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 33aab1cea123e3781de720158f4f5b2f386cadd84c613bf038d1e00bd06e075e
Instruction ID: e60a83dcb55e284f2295618c1591aeb79a9b343b63b9297b92e2a6cf7d5ae6c5
Opcode Fuzzy Hash: 33aab1cea123e3781de720158f4f5b2f386cadd84c613bf038d1e00bd06e075e
Instruction Fuzzy Hash: E3C169BEE013019FE71ACF28E4A0715BBE1BB85315F4886AED069CB385DBB894D0C751

Function 00EC8E9A Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 267COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EC923C

Part of subcall function 00ECA682: type_info::operator==.LIBCMT ref: 00ECA69A

Strings

saved successfull, xrefs: 00EC91FB
Config: , xrefs: 00EC91CE
saved failed, xrefs: 00EC9204

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_type_info::operator==
String ID: saved failed$ saved successfull$Config:
API String ID: 195168595-2058305194
Opcode ID: 08170909082917bc3d36dee14cbd3bebd28bbcf8b66d0665e0b61cac211baad9
Instruction ID: ff50b62100832e2f6051259a19c3453820da243665bc21ba957d9621b3e665fa
Opcode Fuzzy Hash: 08170909082917bc3d36dee14cbd3bebd28bbcf8b66d0665e0b61cac211baad9
Instruction Fuzzy Hash: 95B19F711083819FD324DB24CA96FAFBBE4AF88304F14191DF499A3292DF75A949CB53

Function 00ECDC8D Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ECDD05
_memmove.LIBCMT ref: 00ECDD3D
_memmove.LIBCMT ref: 00ECDD64

Strings

invalid string position, xrefs: 00ECDD95
string too long, xrefs: 00ECDD8B

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: e0c98200c4cee57d660caa92e3ecf8fb1f57ebf3bc5eae997bfda090c8f6d7fb
Instruction ID: e72523c3f9c786d6a30af984e226c785bf101bbd00e37bee7cab22b0389d16f8
Opcode Fuzzy Hash: e0c98200c4cee57d660caa92e3ecf8fb1f57ebf3bc5eae997bfda090c8f6d7fb
Instruction Fuzzy Hash: 7E418E717087049BDB289E18EE40F66BBB5EB41704B201A3EE853A7281D7739D42C795

Function 00ECD058 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECD05F
_memmove.LIBCMT ref: 00ECD085
_swscanf.LIBCMT ref: 00ECD0A5

Part of subcall function 00ED79A8: _vscan_fn.LIBCMT ref: 00ED79BC

_swscanf.LIBCMT ref: 00ECD0D9

Strings

%lf, xrefs: 00ECD09F, 00ECD0D3

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _swscanf$H_prolog3__memmove_vscan_fn
String ID: %lf
API String ID: 1657623499-2891890143
Opcode ID: 8effe8b9294bdc399f50ddd11502c64e14ccf8d844071da3b8442f3bb7259fd7
Instruction ID: 11dbaa4488f3b7e4bf097bd1eb66ad2afc28ffc36c505c6cc00b92a1c06305d2
Opcode Fuzzy Hash: 8effe8b9294bdc399f50ddd11502c64e14ccf8d844071da3b8442f3bb7259fd7
Instruction Fuzzy Hash: 4D419F72C05208AECF14EBA4DA92EDDFBB5EF54300F20512DF419B7291DB325A46CB91

Function 028A853C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,02BBCCE0,028A891F), ref: 028A857F
Sleep.KERNEL32(00000000,02BBCCE0,028A891F), ref: 028A85A2
SwitchToThread.KERNEL32(02BBCCE0,028A891F), ref: 028A85A9

Strings

gfff, xrefs: 028A8586
gfff, xrefs: 028A855D

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$SwitchThread
String ID: gfff$gfff
API String ID: 695535604-3084402119
Opcode ID: d225c494b474af83b97696f61e97230c2f486fc06a160b4851d0c06e49f45fbc
Instruction ID: d1fa2d0af7bd33ce6f3fc207b0c6b981cba778fbfe2c71e1ddd8fc5efc8e0d48
Opcode Fuzzy Hash: d225c494b474af83b97696f61e97230c2f486fc06a160b4851d0c06e49f45fbc
Instruction Fuzzy Hash: 2D01887DB045158FFB6C6E3D98A47282193B781305F488625DD16CE285DF64D5818563

Function 00EC1A46 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00EC1AF6

Part of subcall function 00EC18EF: std::_System_error::_System_error.LIBCPMT ref: 00EC1945

Strings

ios_base::badbit set, xrefs: 00EC1A72
|q, xrefs: 00EC1A8F
ios_base::failbit set, xrefs: 00EC1AA4
ios_base::eofbit set, xrefs: 00EC1AC8

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Exception@8System_errorSystem_error::_Throwstd::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$|q
API String ID: 3384526707-1218138082
Opcode ID: b03111586f9b24d1177dc27ec7f7ff7b564a177c59adeab820cd80ae4e8b6615
Instruction ID: bf08073853889c9e236cca27c2f74a55cffdfba094f96e96e3b54fb6f60450c6
Opcode Fuzzy Hash: b03111586f9b24d1177dc27ec7f7ff7b564a177c59adeab820cd80ae4e8b6615
Instruction Fuzzy Hash: CD0165716893087AC314EA44CE03F6AB7D56B56B04F50948DBA58761C3E6F2D806F743

Function 00ED0E21 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(__Get__JsonConfigImpl__Instance__,00000000), ref: 00ED0E35

Strings

__Get__JsonConfigImpl__Instance__, xrefs: 00ED0E29, 00ED0E2E
' doesn't found in library: ', xrefs: 00ED0E5B
C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe, xrefs: 00ED0E67
function with name: ', xrefs: 00ED0E43

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AddressProc
String ID: function with name: '$' doesn't found in library: '$C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe$__Get__JsonConfigImpl__Instance__
API String ID: 190572456-2709884901
Opcode ID: 6d5e3c188070be9d94f720b65f1cfb2f74129a7ccdef66cb9313db245278885e
Instruction ID: 3810cebdef0ac1d1b981be7eeb478251d49ee7b803ed7898775c86eb16c97bb3
Opcode Fuzzy Hash: 6d5e3c188070be9d94f720b65f1cfb2f74129a7ccdef66cb9313db245278885e
Instruction Fuzzy Hash: BDF0A750F1810C078B0472B40D0AF6B75DBEBD4718314693A2805EB792ECA1CC1367E6

Function 00ECF0B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00ED5F77: _malloc.LIBCMT ref: 00ED5F8F

std::exception::exception.LIBCMT ref: 00ED14A2
__CxxThrowException@8.LIBCMT ref: 00ED14B7

Strings

0p, xrefs: 00ED14AF
8p, xrefs: 00ED1494, 00ED149E
0p, xrefs: 00ED14AC, 00ED149F, 00ED14B6

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: 0p$0p$8p
API String ID: 4063778783-2513132658
Opcode ID: 26acb8637e03ab555a239c810902dde94335e01d11ec91a28110fc90d0a0e90d
Instruction ID: e7442c6e95a46dc50de306c29d0f830c5a400d781eb3cdbc523eb124fff09f4a
Opcode Fuzzy Hash: 26acb8637e03ab555a239c810902dde94335e01d11ec91a28110fc90d0a0e90d
Instruction Fuzzy Hash: 65F090745012099ECB18DB64C916FEAB3E4EF00704F4454AD9401AB291EFB19506CA90

Function 00ED5F77 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00ED5F8F

Part of subcall function 00ED7C4D: __FF_MSGBANNER.LIBCMT ref: 00ED7C64
Part of subcall function 00ED7C4D: __NMSG_WRITE.LIBCMT ref: 00ED7C6B
Part of subcall function 00ED7C4D: HeapAlloc.KERNEL32(00640000,00000000,00000001,?,?,?,?,00ED5F94,?), ref: 00ED7C90

std::exception::exception.LIBCMT ref: 00ED5FAD
__CxxThrowException@8.LIBCMT ref: 00ED5FC2

Part of subcall function 00ED8E6B: RaiseException.KERNEL32(?,?,?,00F00F18,?,?,?,?,?,00ED5FC7,?,00F00F18,?,00000001), ref: 00ED8EC0

Strings

8p, xrefs: 00ED5FA2
0p, xrefs: 00ED5FBA

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: 0p$8p
API String ID: 1059622496-205464857
Opcode ID: 4a23750255b7389fdecae432da7b626da756cb5dd26810f038a1df1b3c45d4b1
Instruction ID: ac58e30be84780a68d47cc5573c6a7eb1abbeeed36943c12524c0d469b4598af
Opcode Fuzzy Hash: 4a23750255b7389fdecae432da7b626da756cb5dd26810f038a1df1b3c45d4b1
Instruction Fuzzy Hash: B3E0E53160460EAACF14FB60CC029EE7BB9FF10350F102457BC14BA2D1EF709A46A9D0

Function 00ED0DDD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00ED5209: type_info::_Name_base.LIBCMT ref: 00ED5210

_strrchr.LIBCMT ref: 00ED0DF2
_strrchr.LIBCMT ref: 00ED0E00
swprintf.LIBCMT ref: 00ED0E15

Strings

__Get__%s__Instance__, xrefs: 00ED0E09
__Get__JsonConfigImpl__Instance__, xrefs: 00ED0E10

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _strrchr$Name_baseswprintftype_info::_
String ID: __Get__%s__Instance__$__Get__JsonConfigImpl__Instance__
API String ID: 3025227637-851679673
Opcode ID: 9f23b3802aa791ac7177589a562b9306d8d60842c4ad0e8aba364de8c7fca72c
Instruction ID: 259ee3108d5dd469cab1d932cce6a88aabe6100ce3430fd4d5aeb0226ce11dc8
Opcode Fuzzy Hash: 9f23b3802aa791ac7177589a562b9306d8d60842c4ad0e8aba364de8c7fca72c
Instruction Fuzzy Hash: 4DE0C26328DB25A4F11431A52C07F7B0689CF21F20F50201BFA89BA2C2F8805D4320AE

Function 028A5CE8 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,028A5959), ref: 028A5D7E
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,028A5959), ref: 028A5D98

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 74d3c67c94f10dc1a255572e8e274353d3dca05eb5513f19443b276ea201fe0e
Instruction ID: 39a72db7d9ca09904e835b91efbdfb79d7b260100c90c40ce696ccfe7acd4684
Opcode Fuzzy Hash: 74d3c67c94f10dc1a255572e8e274353d3dca05eb5513f19443b276ea201fe0e
Instruction Fuzzy Hash: 7861E37DE452009FE716CF28C998B16BBE1AF45314F98857ED488CB391DBB894C1CB51

Function 00EE4FCC Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00EE4FD8

Part of subcall function 00ED7C4D: __FF_MSGBANNER.LIBCMT ref: 00ED7C64
Part of subcall function 00ED7C4D: __NMSG_WRITE.LIBCMT ref: 00ED7C6B
Part of subcall function 00ED7C4D: HeapAlloc.KERNEL32(00640000,00000000,00000001,?,?,?,?,00ED5F94,?), ref: 00ED7C90

_free.LIBCMT ref: 00EE4FEB

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ec73e7dc3966c11a7588aa3c9ef38b332d0dfc4f1417670b36ad077230257134
Instruction ID: 6b44f4fa3474b3fa46aa0c30b27a034671efa7f82ceae246dbe56d3275b9a44a
Opcode Fuzzy Hash: ec73e7dc3966c11a7588aa3c9ef38b332d0dfc4f1417670b36ad077230257134
Instruction Fuzzy Hash: 56110A735046599FCB203F75AC04AA93BD4EF00768F203526F90DBA291DE358C81C6D4

Function 00ECBF9E Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?), ref: 00ECBFB8
WTSGetActiveConsoleSessionId.KERNEL32 ref: 00ECBFEB
WTSQueryUserToken.WTSAPI32(00000000,?), ref: 00ECBFF6
DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?), ref: 00ECC011
CloseHandle.KERNEL32(?), ref: 00ECC01E

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Token$ActiveCloseConsoleDuplicateEnumerateHandleQuerySessionSessionsUser
String ID:
API String ID: 1051198271-0
Opcode ID: 58b8e133f5254873db491ecf54606f64fb4f086cb956cb30a4489e47aca86380
Instruction ID: f1cccf4c35a1362df58ad9f95deb57e65366c8474ee7337a19dca45cbcb15311
Opcode Fuzzy Hash: 58b8e133f5254873db491ecf54606f64fb4f086cb956cb30a4489e47aca86380
Instruction Fuzzy Hash: B9112B75A00149AFDB209FA1DD85EBEB7B8EB44345F10106DF906F6241D7729E4ACA60

Function 00ECCB8D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECCB94

Part of subcall function 00ECE073: __EH_prolog3.LIBCMT ref: 00ECE07A

Strings

Missing ',' or '}' in object declaration, xrefs: 00ECCD6B
Missing ':' after object member name, xrefs: 00ECCD81
Missing '}' or object member name, xrefs: 00ECCD19

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID: Missing ',' or '}' in object declaration$Missing ':' after object member name$Missing '}' or object member name
API String ID: 3355343447-3980781130
Opcode ID: 5bd9f3f7dbcdc23f2e419b9116cfe939e4a60e13e35796b42306feed440933b4
Instruction ID: e3f949bfe6ea87e89cbd894553ab856693290a9bec7381c61da914b751b852de
Opcode Fuzzy Hash: 5bd9f3f7dbcdc23f2e419b9116cfe939e4a60e13e35796b42306feed440933b4
Instruction Fuzzy Hash: 24518670E042089ACF14EBA4CA96FEDBBF99B15704F30241DF50AB7281DB67990BC651

Function 00ECF709 Relevance: 6.2, APIs: 4, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECF713
_strpbrk.LIBCMT ref: 00ECF729
_Smanip.LIBCPMT ref: 00ECF89D
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ECF90F

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_Ios_base_dtorSmanip_strpbrkstd::ios_base::_
String ID:
API String ID: 140218247-0
Opcode ID: 520fdbbcb5be9828974e3376d544a4156145b76f6030d7ca19f56dfb7fe8d831
Instruction ID: 3e80d1dd4f3d66d0a87a770bed51800c223435c3642015dbdf4c9ef78d54b238
Opcode Fuzzy Hash: 520fdbbcb5be9828974e3376d544a4156145b76f6030d7ca19f56dfb7fe8d831
Instruction Fuzzy Hash: 35810371504244AEDB18EBA4CE56FFD7BE69F41708F24206DF501BB1C2DA729A478B21

Function 00EC9AAE Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

_fgetc.LIBCMT ref: 00EC9C64
_ungetc.LIBCMT ref: 00EC9C9E

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _fgetc_ungetc
String ID:
API String ID: 2224984641-0
Opcode ID: 3cec09a301ac4c209abef3cbe00e42fff9f3039f9a37ac81389fc0afe7f0f261
Instruction ID: 934e270f31f627d2b5fd4da3bffe97e3e3b82b0ffa5907bd3aa62f1385fbb588
Opcode Fuzzy Hash: 3cec09a301ac4c209abef3cbe00e42fff9f3039f9a37ac81389fc0afe7f0f261
Instruction Fuzzy Hash: 66516D722083419FCB14DF28D584E6AB7E8FF88314F501A6EF885A7292D736E945CB52

Function 00EDA147 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00EDA1D8
_memmove.LIBCMT ref: 00EDA24C
___AdjustPointer.LIBCMT ref: 00EDA29D
_memmove.LIBCMT ref: 00EDA2A6

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: b2b6714a2dbd374a55214244c75ae21abccf1e49aeee23861fd13572fa4f3402
Instruction ID: 9871a0c27c158851eb6aa1db060d10639a052af5db0b4aecd1ee33b1f7e1cb87
Opcode Fuzzy Hash: b2b6714a2dbd374a55214244c75ae21abccf1e49aeee23861fd13572fa4f3402
Instruction Fuzzy Hash: B84198762143065EEB245F1AD841B6A33E5EF01314F2C503FE941AA7E1EF62DB82D616

Function 00ED71BF Relevance: 6.1, APIs: 4, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED7255
__flush.LIBCMT ref: 00ED7275
__write.LIBCMT ref: 00ED72A8
__flsbuf.LIBCMT ref: 00ED72D6

Part of subcall function 00ED83C7: __getptd_noexit.LIBCMT ref: 00ED83C7

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 43d01f7fc4635858c90511c48601a20eff9624f6919872c962e24f8929bb2eae
Instruction ID: ff12d7ed2fd187a812d0f0b74b21330df30e8f2526c7257a86a582d16bebf2e3
Opcode Fuzzy Hash: 43d01f7fc4635858c90511c48601a20eff9624f6919872c962e24f8929bb2eae
Instruction Fuzzy Hash: E64103716087459FDB189FA9D8809AE77A5EF40364B24A63FF885E7350F770DD828B40

Function 00EEE39C Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00EEE3D2
__isleadbyte_l.LIBCMT ref: 00EEE400
MultiByteToWideChar.KERNEL32(00000080,00000009,00ED5D4B,00000001,00000000,00000000,?,00000000,00000000), ref: 00EEE42E
MultiByteToWideChar.KERNEL32(00000080,00000009,00ED5D4B,00000001,00000000,00000000,?,00000000,00000000), ref: 00EEE464

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f02b2c5a28d608bb6694328d7340044c7d838616b4ba21c794a9f12689198b76
Instruction ID: 0b000819820bf04e6b1c31f25ec5adcb3e3ddfd730937aba20edc742c881b8ca
Opcode Fuzzy Hash: f02b2c5a28d608bb6694328d7340044c7d838616b4ba21c794a9f12689198b76
Instruction Fuzzy Hash: 7231B03060028AEFDB218F76C845BAE7BA5FF41314F155469E864A72E0E730D851DB90

Function 028ADB58 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 028ADB69
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 028ADBC7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 028ADC24
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 028ADC57

Part of subcall function 028ADB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,028ADBD5), ref: 028ADB2B
Part of subcall function 028ADB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,028ADBD5), ref: 028ADB48

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: a8b8e52c83af8e9f7fe4430bd6e192b1576ca128aa25af30439680bc006aae80
Instruction ID: feeb74ddb4968ad320b55994106d65bc7c866abef8c6c37fbda72cd43cc60898
Opcode Fuzzy Hash: a8b8e52c83af8e9f7fe4430bd6e192b1576ca128aa25af30439680bc006aae80
Instruction Fuzzy Hash: 36315078E0011E9BEB10DFE8C8947AEB7B9FF08304F504566E525E7290EBB49A05CB91

Function 028A7130 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 028A71A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 028A71AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 028A71B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 028A71E2

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction ID: bc7b3a5dfc478c5f247cfe1e2fad7b365c5804eac7e79ec479fa4dc887fab3c4
Opcode Fuzzy Hash: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction Fuzzy Hash: 59214F7A58C3C02FE7169B244D22B5DBFE4ABC2700F08849FE185CA1D3DA788505D753

Function 00EE40FD Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00EE4121

Part of subcall function 00EE4808: __fltout2.LIBCMT ref: 00EE4831

__cftog_l.LIBCMT ref: 00EE4147
__cftoe_l.LIBCMT ref: 00EE4179

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 15be52fb40dd2e5b9c3209c371360714c3e1f86666dd268b276cc11122cb911b
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: B7018CB200128EBBCF165E85CC01CEE3F67BB29344F099455FA1869071C336C9B1AB81

Function 00ED9A7A Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00ED9A91

Part of subcall function 00EDA0B9: ___AdjustPointer.LIBCMT ref: 00EDA102

_UnwindNestedFrames.LIBCMT ref: 00ED9AA8
___FrameUnwindToState.LIBCMT ref: 00ED9ABA
CallCatchBlock.LIBCMT ref: 00ED9ADE

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 0f9fa0e7b552339f679d12fe7fa2ea03fb565256a3b7d664afd995a63f1e5350
Instruction ID: 40a1ad9402bdaaeddf23bd6eb7c5f1cdadf950fb195ff48cf3dfa9327faa3ee7
Opcode Fuzzy Hash: 0f9fa0e7b552339f679d12fe7fa2ea03fb565256a3b7d664afd995a63f1e5350
Instruction Fuzzy Hash: 41012532000109BBCF12AF95CC01EDE3BBAFF48754F059116F91876222D372E862EBA0

Function 028A716C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 028A71A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 028A71AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 028A71B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 028A71E2

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction ID: a0fb84961b9017336c51e48dad5ecbd3959be96f52939a98b5bbf9fefdd9e7ac
Opcode Fuzzy Hash: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction Fuzzy Hash: 2B01A7756883047AE724AB689C12F9F76D9DFC4B10F04882DB288DA1D1DAF989444B53

Function 00EC8295 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EC829C

Part of subcall function 00ED5F77: _malloc.LIBCMT ref: 00ED5F8F

std::_Locinfo::_Locinfo.LIBCPMT ref: 00EC82D1

Part of subcall function 00EC135C: __EH_prolog3.LIBCMT ref: 00EC1363
Part of subcall function 00EC135C: std::_Lockit::_Lockit.LIBCPMT ref: 00EC1370
Part of subcall function 00EC135C: std::exception::exception.LIBCMT ref: 00EC13B7
Part of subcall function 00EC135C: __CxxThrowException@8.LIBCMT ref: 00EC13CC
Part of subcall function 00EC135C: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EC13D5

numpunct.LIBCPMT ref: 00EC82EF

Part of subcall function 00EC838B: __EH_prolog3_catch.LIBCMT ref: 00EC8392
Part of subcall function 00EC838B: _localeconv.LIBCMT ref: 00EC839C
Part of subcall function 00EC838B: __Getcvt.LIBCPMT ref: 00EC83A7
Part of subcall function 00EC838B: __Getcvt.LIBCPMT ref: 00EC83D4

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EC8302

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: std::_$GetcvtH_prolog3LocinfoLocinfo::_$Exception@8H_prolog3_catchLocinfo::~_Locinfo_ctorLockitLockit::_Throw_localeconv_mallocnumpunctstd::exception::exception
String ID:
API String ID: 2227016329-0
Opcode ID: d440bc3dbc0718fe893f90b5d722f5c124581e6a6daaa460436b16665a58906b
Instruction ID: 004c63e225890e21c85f6a2a410161c844f306310e98d14482dd045e25fa55f0
Opcode Fuzzy Hash: d440bc3dbc0718fe893f90b5d722f5c124581e6a6daaa460436b16665a58906b
Instruction Fuzzy Hash: 5C01B1719002159BCB109F98C746BADBBA0FF44B44F64601EB444B7281CF725E02CB80

Function 00EC9806 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

, xrefs: 00EC9987

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: de22d451b46f4fcc293e280e624ff38b6389bda950812ba7f8c733e7bd0186a3
Instruction ID: 1f2e8d4367195e6f29f244cc501a3537fcc20bb96036a564879fe670fa1a3093
Opcode Fuzzy Hash: de22d451b46f4fcc293e280e624ff38b6389bda950812ba7f8c733e7bd0186a3
Instruction Fuzzy Hash: E8518C722083019FCB24CF28C985E6AB7F5FF88718F505A2DF495A3291D771E946CB52

Function 00ECD223 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECD22A

Part of subcall function 00ECD577: __EH_prolog3_GS.LIBCMT ref: 00ECD57E

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

Strings

Empty escape sequence in string, xrefs: 00ECD365
Bad escape sequence in string, xrefs: 00ECD33E

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_$_memmove
String ID: Bad escape sequence in string$Empty escape sequence in string
API String ID: 2992230404-928816353
Opcode ID: 0d4f7eb7da5a92c7882ac046dab2fd387f9bc23ff264b8fdb4e180a7d3904d9d
Instruction ID: b82ee540879385d8c6ec5fd4091dfd4d3d4132267d946eb8af5897aa03341b1d
Opcode Fuzzy Hash: 0d4f7eb7da5a92c7882ac046dab2fd387f9bc23ff264b8fdb4e180a7d3904d9d
Instruction Fuzzy Hash: 7541C230908249EADF24EA988F85FEDB7B4EB51704F20602DF515BB2D2CA639D43D752

Function 00EC22B1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00EC22F8

Part of subcall function 00ED5F26: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00EC22FD,?,057A9A68), ref: 00ED5F2F
Part of subcall function 00ED5F26: __aulldiv.LIBCMT ref: 00ED5F4F

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EC23CE

Strings

SuccessUpdated, xrefs: 00EC2303

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Time$FileIos_base_dtorSystem__aulldiv__time64std::ios_base::_
String ID: SuccessUpdated
API String ID: 278407793-4085629077
Opcode ID: 09bcf7fe7809b838453ecb8d245862359a3ba62b39d0de430ac4af12193f8e1f
Instruction ID: 78cba4a1f3a07134b5ba53ceede231c9595a94c11613ad92940509d94c672da9
Opcode Fuzzy Hash: 09bcf7fe7809b838453ecb8d245862359a3ba62b39d0de430ac4af12193f8e1f
Instruction Fuzzy Hash: 4A41D271108381CFC724DF28C985FAEB7E4FF98704F005A2EB185A3281DB719945CB62

Function 00ECD396 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECD39D

Part of subcall function 00ECD49E: __EH_prolog3_GS.LIBCMT ref: 00ECD4A5

Part of subcall function 00ECD577: __EH_prolog3_GS.LIBCMT ref: 00ECD57E

Strings

expecting another \u token to begin the second half of a unicode surrogate pair, xrefs: 00ECD470
additional six characters expected to parse unicode surrogate pair., xrefs: 00ECD3EA

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_
String ID: additional six characters expected to parse unicode surrogate pair.$expecting another \u token to begin the second half of a unicode surrogate pair
API String ID: 2427045233-1961466578
Opcode ID: b106c125f58f9b537b8388cd8bf74679d5f81245e66e8be326920add1b173a6d
Instruction ID: 99abb657a639a9364da7b84afd048e9b8c25aff4c48b58a38f7f4343ecae8e2f
Opcode Fuzzy Hash: b106c125f58f9b537b8388cd8bf74679d5f81245e66e8be326920add1b173a6d
Instruction Fuzzy Hash: 8C316770A04209ABCF189F90CE41FEDBBB6BF58310F24242CE651B7281D633A957DB60

Function 00ECDBBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ECDC40
_memmove.LIBCMT ref: 00ECDC5B

Strings

string too long, xrefs: 00ECDC82

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove
String ID: string too long
API String ID: 4104443479-2556327735
Opcode ID: 3a3a7bc789acc55fc7d95a1e9eebf24240c630e785c4ece6015646e502b1d382
Instruction ID: b554f16e2abba1d6ab68c99b445f74f37687e3badf7a202673e444cc17e8f42c
Opcode Fuzzy Hash: 3a3a7bc789acc55fc7d95a1e9eebf24240c630e785c4ece6015646e502b1d382
Instruction Fuzzy Hash: C4219F712087049BDA349E189E44FA7F7F9EB40754B102A3DB4A2A7381C7B39C46C790

Function 00ECD49E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECD4A5

Part of subcall function 00ECD577: __EH_prolog3_GS.LIBCMT ref: 00ECD57E

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

Strings

Bad unicode escape sequence in string: hexadecimal digit expected., xrefs: 00ECD53C
Bad unicode escape sequence in string: four digits expected., xrefs: 00ECD4C5

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_$_memmove
String ID: Bad unicode escape sequence in string: four digits expected.$Bad unicode escape sequence in string: hexadecimal digit expected.
API String ID: 2992230404-3825735986
Opcode ID: 0a4807c67f2cea53e782eb064979acc0d20df5361bd065603cdbae5baadea3c6
Instruction ID: 9dad0876b69cf7060049a5321546cc78efd52960601a840bf62624b78f69f152
Opcode Fuzzy Hash: 0a4807c67f2cea53e782eb064979acc0d20df5361bd065603cdbae5baadea3c6
Instruction Fuzzy Hash: 02218B75904228DBCF10DF64CD81FED7BB4EB46724F10206AE111BB390C672A907CB50

Function 00ED06AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00ED07EE

Strings

/restart --ppapi-flash-path=./pepflashplayer.dll, xrefs: 00ED06EF
/s, xrefs: 00ED0709, 00ED070E, 00ED0716

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExitProcess
String ID: /s$/restart --ppapi-flash-path=./pepflashplayer.dll
API String ID: 621844428-305281092
Opcode ID: fd021d067fb3270f82c59053a1f2b2292b7ec14ca6cf08d2c7f4a1490618702c
Instruction ID: 2866b8fea38a04ba29264eae9c4aa45f415f46f3fc5669cc6de357b1ceddda7b
Opcode Fuzzy Hash: fd021d067fb3270f82c59053a1f2b2292b7ec14ca6cf08d2c7f4a1490618702c
Instruction Fuzzy Hash: 59319EB00083C49ED320EB24C992FEBBBE8EB95314F04591DB599A62D1DBB15909CB63

Function 00EC4949 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EC4950
__Stoulx.LIBCPMT ref: 00EC49BA

Strings

-, xrefs: 00EC49F1

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_Stoulx
String ID: -
API String ID: 3180878350-2547889144
Opcode ID: f2f6dc805e3559dc7f21d77a07d63ddbd3f16dbb9d9dfafbcf877c2bc0b9733d
Instruction ID: 18d00e466e1b10ca7f8b2b2e10befe3274c25113df19aa5330e72340a5072544
Opcode Fuzzy Hash: f2f6dc805e3559dc7f21d77a07d63ddbd3f16dbb9d9dfafbcf877c2bc0b9733d
Instruction Fuzzy Hash: F7214BB2900218ABCF15DF94DA81EEEB7F8EF49314F00515AF812B7281EB359E06CB51

Function 00EC4A1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EC4A23
__Stoulx.LIBCPMT ref: 00EC4A8D

Strings

-, xrefs: 00EC4ABE

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3_Stoulx
String ID: -
API String ID: 3180878350-2547889144
Opcode ID: 930adb963e6fe165bbb95e051afe82bd2146f9ce77b31c4c9026ad039f4115a4
Instruction ID: 1a4d56d0cd723a95613bd2cbb1a8031e5b1f29237920be0c2cd8553d682a3fd2
Opcode Fuzzy Hash: 930adb963e6fe165bbb95e051afe82bd2146f9ce77b31c4c9026ad039f4115a4
Instruction Fuzzy Hash: A02119B2900219AFCF11DF94DA81EEDB7F8EB49314F04525AF811B7281EB35AE16CB50

Function 00EC4162 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EC41D2

Strings

invalid string position, xrefs: 00EC414D
string too long, xrefs: 00EC4157, 00EC41F9

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 81a4b1f94e2ec75dd2e6d450aa0dd29f6ba14530b33118ae43a2545841840176
Instruction ID: dc4cc4d4d6dd75fc5976e0f0f1fe884599c725cbe4c3709fbf25e64fe6edd1bf
Opcode Fuzzy Hash: 81a4b1f94e2ec75dd2e6d450aa0dd29f6ba14530b33118ae43a2545841840176
Instruction Fuzzy Hash: 6F1124B13013049BDB34DE198E64F66BBF8EB51710B18191DF981A73C1C772A887C790

Function 00EC5AC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EC5B25

Strings

invalid string position, xrefs: 00EC5B58
string too long, xrefs: 00EC5B62

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: e4aa3f57f5b92db2a37bb84fd38b85bdfe9ec68e890a177bf51aa272d97ca938
Instruction ID: 7c7e67203f4f2a1f0888a4ba6864472527c23737181eb00c08b68258a0afa2bc
Opcode Fuzzy Hash: e4aa3f57f5b92db2a37bb84fd38b85bdfe9ec68e890a177bf51aa272d97ca938
Instruction Fuzzy Hash: A311A532300B449BC7349E58DA80E67BBE9EB81750720192EF456A7781D772FC868790

Function 00EC2597 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00EC25DC

Part of subcall function 00ED5F26: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00EC22FD,?,057A9A68), ref: 00ED5F2F
Part of subcall function 00ED5F26: __aulldiv.LIBCMT ref: 00ED5F4F

Part of subcall function 00EC3E89: __EH_prolog3.LIBCMT ref: 00EC3E90

Part of subcall function 00EC3538: __EH_prolog3_catch.LIBCMT ref: 00EC353F

Part of subcall function 00EC7CE0: __EH_prolog3.LIBCMT ref: 00EC7CE7

Part of subcall function 00EC4331: _memmove.LIBCMT ref: 00EC4351

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EC2674

Part of subcall function 00ED1371: std::ios_base::_Tidy.LIBCPMT ref: 00ED1391

Strings

SuccessUpdated, xrefs: 00EC262A

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: H_prolog3Timestd::ios_base::_$FileH_prolog3_catchIos_base_dtorSystemTidy__aulldiv__time64_memmove
String ID: SuccessUpdated
API String ID: 1968254119-4085629077
Opcode ID: 048c773ff2f9894d5663600b16bea487a1f5b23965cf5a3c1682c63c8c34f434
Instruction ID: c06c3192c6410fae3ef5ff829ecd799c1dd2d69621645561f6b5681b66c50e72
Opcode Fuzzy Hash: 048c773ff2f9894d5663600b16bea487a1f5b23965cf5a3c1682c63c8c34f434
Instruction Fuzzy Hash: 852153725183809FC724EB64D956F9AB7E8FB88710F004E1EF19AA32D0DF759509CB52

Function 00ECDF06 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ECDF57

Part of subcall function 00ED5075: std::exception::_Copy_str.LIBCMT ref: 00ED508E

__CxxThrowException@8.LIBCMT ref: 00ECDF6C

Part of subcall function 00ED8E6B: RaiseException.KERNEL32(?,?,?,00F00F18,?,?,?,?,?,00ED5FC7,?,00F00F18,?,00000001), ref: 00ED8EC0

Strings

pp, xrefs: 00ECDF64

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: pp
API String ID: 757275642-553409941
Opcode ID: db92e07a58f443cf680c1f739a7d79df33fe1913b584094ef21d2c8f650acbd1
Instruction ID: f0685c75f3b1f03315c4e33d2461e8e54261f7f8465445b119d73e338a01b902
Opcode Fuzzy Hash: db92e07a58f443cf680c1f739a7d79df33fe1913b584094ef21d2c8f650acbd1
Instruction Fuzzy Hash: BE01DB34504208AFC710EF64C805E99B7F8FF55310B1051AEF89177361DB72A846DB91

Function 00ECE596 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ECE5F8
__CxxThrowException@8.LIBCMT ref: 00ECE60D

Strings

pp, xrefs: 00ECE605

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: pp
API String ID: 3728558374-553409941
Opcode ID: 83676de95db739e6c75845994d5018ec647bba1660123d7d8cb378c658d4fd2b
Instruction ID: d397b314cb3973c271f220c2470278942eae88ae961f61e8071b5512230f57f6
Opcode Fuzzy Hash: 83676de95db739e6c75845994d5018ec647bba1660123d7d8cb378c658d4fd2b
Instruction Fuzzy Hash: EA01817081C50CDEC712DB74D911AA9B7B8EF42748B24539BE002BB291F776A987DA41

Function 00ED14EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ED14FE

Part of subcall function 00ED5075: std::exception::_Copy_str.LIBCMT ref: 00ED508E

__CxxThrowException@8.LIBCMT ref: 00ED1513

Part of subcall function 00ED8E6B: RaiseException.KERNEL32(?,?,?,00F00F18,?,?,?,?,?,00ED5FC7,?,00F00F18,?,00000001), ref: 00ED8EC0

Strings

dp, xrefs: 00ED150B

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: dp
API String ID: 757275642-3046927575
Opcode ID: c4c743eee30fa052681443082c2aedbf6df5e995bfeb4e3ed722cfd4b1f30f00
Instruction ID: 77cc8571a31a011bffa94bafeab4822f9b5f696f87e38f58be1cdab159c57866
Opcode Fuzzy Hash: c4c743eee30fa052681443082c2aedbf6df5e995bfeb4e3ed722cfd4b1f30f00
Instruction Fuzzy Hash: 30D06775C0420DBBCB10EFA4C84A8CDBBB8EA44344F009466BD54A7241EA74E34A9B91

Function 00ED14BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ED14D0

Part of subcall function 00ED5075: std::exception::_Copy_str.LIBCMT ref: 00ED508E

__CxxThrowException@8.LIBCMT ref: 00ED14E5

Part of subcall function 00ED8E6B: RaiseException.KERNEL32(?,?,?,00F00F18,?,?,?,?,?,00ED5FC7,?,00F00F18,?,00000001), ref: 00ED8EC0

Strings

Xp, xrefs: 00ED14DD

Memory Dump Source

Source File: 00000003.00000002.2905920483.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.2905876979.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905970319.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2905993375.0000000000F03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2906028397.0000000000F08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: Xp
API String ID: 757275642-3511499088
Opcode ID: 07e3cda70c55433229739b3b11ad433d167eebacf8be64a7d94e96f4b71edc91
Instruction ID: e772e7b52fe8da50a613930d75f95b530fbcd1b1e70f59fe81d666813df872cf
Opcode Fuzzy Hash: 07e3cda70c55433229739b3b11ad433d167eebacf8be64a7d94e96f4b71edc91
Instruction Fuzzy Hash: 70D06775C0060DBBCB10EFA4C44ACDDBBBCEA44344F009466BD54A7281EA74E2499BD1

Function 028B032C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 028B0335
TlsGetValue.KERNEL32(0000001E), ref: 028B034A

Strings

gf, xrefs: 028B034F

Memory Dump Source

Source File: 00000003.00000002.2906516386.00000000028A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028A0000, based on PE: true

Associated: 00000003.00000002.2906516386.0000000002BBF000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2906757615.0000000002C15000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_28a0000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocValue
String ID: gf
API String ID: 1189806713-1784458641
Opcode ID: 80d4bb81aad4b267e90bdb44323f7bfce59122a77a1c98ebdefa77fa2b5abbb7
Instruction ID: 15c607b771e2243aed7f6448f5e520b0106c1a8c078164a4748b88ea8dbc52fe
Opcode Fuzzy Hash: 80d4bb81aad4b267e90bdb44323f7bfce59122a77a1c98ebdefa77fa2b5abbb7
Instruction Fuzzy Hash: 08C0127CD8120147DB437BFC91055AB33955F04388B140C285114CB340EF34D0159B15

Analysis Process: LKdayanJELT9QDD900055.exePID: 6524, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1734
Total number of Limit Nodes:	12

Executed Functions

Function 0040DFBC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E1E4,?,?,?), ref: 0040DFFB
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,0040E1E4,?,?,?), ref: 0040E044
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,0040E1E4,?,?,?), ref: 0040E066
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000), ref: 0040E084
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001), ref: 0040E0A2
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002), ref: 0040E0C0
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001), ref: 0040E0DE
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,0040E1C0,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,0040E1E4), ref: 0040E118
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,?,00000000,0040E1C0,?,80000001), ref: 0040E13D
RegCloseKey.ADVAPI32(?,0040E1C7,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,0040E1C0,?,80000001,Software\Embarcadero\Locales), ref: 0040E1B8

Strings

Software\Embarcadero\Locales, xrefs: 0040E03A, 0040E05C
Software\CodeGear\Locales, xrefs: 0040E07A, 0040E098
Software\Borland\Delphi\Locales, xrefs: 0040E0D4
Software\Borland\Locales, xrefs: 0040E0B6

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 3dd22a4be6017880ee98b9af35419f4a6580bec0c2670339552647c08b333375
Instruction ID: 1f40efa043813818a225c00712ee512bf46ff1cf813ab5e4d90819ade4ea10ab
Opcode Fuzzy Hash: 3dd22a4be6017880ee98b9af35419f4a6580bec0c2670339552647c08b333375
Instruction Fuzzy Hash: 0F511971A40319BEEB10D6A6CC42FAF73BCEB08704F64487FB914F61C1D6B8AD108A59

Function 004096A7 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004096CF

Strings

MZP, xrefs: 00409B0F

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CurrentThread
String ID: MZP
API String ID: 2882836952-2889622443
Opcode ID: 0f0b9d4ba0f513e020de236d2fa5291e9aca65089bdba99959f700550737f70c
Instruction ID: 1143bde947ef25d04aa0bb390edf07b3fade30ae7649cc0277b26748aec70394
Opcode Fuzzy Hash: 0f0b9d4ba0f513e020de236d2fa5291e9aca65089bdba99959f700550737f70c
Instruction Fuzzy Hash: D25147706002409FDB25EF6AD48479A77A0AB48328F14857FE849AB3D3D77CDC84CB19

Function 00406510 Relevance: 3.8, APIs: 3, Instructions: 30
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 00406526
Sleep.KERNEL32(0000000A,00000000), ref: 00406540
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004), ref: 0040656F

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$AllocVirtual
String ID:
API String ID: 3510833457-0
Opcode ID: b5ba397028dab13967a865f5e7eb5f13c1185db7d5c14cd6a7909d1fdb7635dc
Instruction ID: 91c1a8ad5d22eb3a659c9bdc7e2464ace2fb9588ca3c16e2fdffe0404517382a
Opcode Fuzzy Hash: b5ba397028dab13967a865f5e7eb5f13c1185db7d5c14cd6a7909d1fdb7635dc
Instruction Fuzzy Hash: 22F0BEE028E39079FB23E364BC0B7C71640430234EF11C0BAA14A792D5C5BD08D98B5E

Function 0040D434 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0040D452

Part of subcall function 0040E6E8: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E7A4,?,MZP,0070BC30), ref: 0040E724
Part of subcall function 0040E6E8: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E7A4,?,MZP,0070BC30), ref: 0040E775

Strings

MZP, xrefs: 0040D435, 0040D451

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID: MZP
API String ID: 4113206344-2889622443
Opcode ID: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction ID: 7075507e26a0e6026a6210eacf9037b76580bd6716ad292e039b2e85647b8463
Opcode Fuzzy Hash: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction Fuzzy Hash: 24E06D71A013108FDB10DEA8D8C1A4733D4AF08714F0449A6BD54EF38AD375DD288BD5

Function 00405644 Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 0040565B

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 814b3b8791c87effa0944dd8d4b7ac59e1c482cca92c8019de47bcdaf1964ee4
Instruction ID: 50bb600baef0d1a5fffbbf75c090446f5a1a9743663961aa01978c10644f879b
Opcode Fuzzy Hash: 814b3b8791c87effa0944dd8d4b7ac59e1c482cca92c8019de47bcdaf1964ee4
Instruction Fuzzy Hash: 3CF08CB2B422116BD7189F7C9E407827BE4EB08355B11C13FE908EB7D5D6B88880CB88

Non-executed Functions

Function 0040DDBC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0040DDD9
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040DDEA
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 0040DEF8
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 0040DF0A
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 0040DF16
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 0040DF5B

Strings

kernel32.dll, xrefs: 0040DDD4
\, xrefs: 0040DF28
GetLongPathNameW, xrefs: 0040DDE4

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 1c3f87d5d752b2f1ed1bd190a3c576e596e34d79bb03105b83562a574db9c890
Instruction ID: cb7579a4ff443e2fe28efdf1a5fcad68c8ca53d5945c324fdcd9a6ee545c0455
Opcode Fuzzy Hash: 1c3f87d5d752b2f1ed1bd190a3c576e596e34d79bb03105b83562a574db9c890
Instruction Fuzzy Hash: 96519431E006159BCB10EAE9CC85A9EB3B5EF44314F1484BAE505F72D1E778AE498B49

Function 00407048 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 80
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00407065
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040706B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 0040707E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 0040708B
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 0040709F
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 004070A5
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 004070C3
GetProcessHeap.KERNEL32(00000000,?,00407127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00407112
HeapFree.KERNEL32(00000000,00000000,?,00407127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00407118

Strings

kernel32.dll, xrefs: 00407060
+!, xrefs: 004070B0
GetLogicalProcessorInformation, xrefs: 0040705B

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Heap$InformationLogicalProcessProcessor$AddressAllocateErrorFreeHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll$+!
API String ID: 3837757292-3207784131
Opcode ID: e1c5193b0ae4525188b8e649ae04c55ab1013d680668caab22f2a53fbdc28020
Instruction ID: 8d03ac4c123160cff7d71f750e22a2a9ac72958470238bbd548057885d22e0da
Opcode Fuzzy Hash: e1c5193b0ae4525188b8e649ae04c55ab1013d680668caab22f2a53fbdc28020
Instruction Fuzzy Hash: DB215171E08208AEDB10EBA59841B5FB7B9EB44314F20C1BBF914FB6C1D67CA9408F19

Function 00408610 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00408625
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040862B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 0040863E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 0040864B
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,004086C4,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00408676

Strings

@, xrefs: 004086CB
kernel32.dll, xrefs: 00408620
GetLogicalProcessorInformation, xrefs: 0040861B

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: ce53bcc55d99381957c5130d61132cd3c09cb4ebf646a5aaaaed8f29e5cad77f
Instruction ID: 1f9ebece4dba77d46bf48797d1c9c36e7467e586b286653d4f79d470888216c8
Opcode Fuzzy Hash: ce53bcc55d99381957c5130d61132cd3c09cb4ebf646a5aaaaed8f29e5cad77f
Instruction Fuzzy Hash: CE118170D00208AEDB10EBA5CA4266EB7B4DF04314F1288BFE854F32D2DB7E8940CE58

Function 00410975 Relevance: 13.8, APIs: 9, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00410A2C

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ef1839ed7ebc85545d9fdedb91a1da59d215e0e36a3b3f92e6a20f5196a8e0cd
Instruction ID: 35b9288e701bd3da194d8afe968180aafa0f1695690edacd064a0e56f7e408ae
Opcode Fuzzy Hash: ef1839ed7ebc85545d9fdedb91a1da59d215e0e36a3b3f92e6a20f5196a8e0cd
Instruction Fuzzy Hash: BDA16DB59003099FDB24CFE9D884BEEB7B5AF48304F14851AE505A7380DBB8ADC5CB58

Function 0040DC74 Relevance: 12.1, APIs: 8, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(0071CC18), ref: 0040DC92
RtlLeaveCriticalSection.NTDLL(0071CC18), ref: 0040DCB6
RtlLeaveCriticalSection.NTDLL(0071CC18), ref: 0040DCC5
IsValidLocale.KERNEL32(00000000,00000002,00000000,0040DD7A,?,?,?,00000000,?,0040E67A,00000000,0040E6DB,?,?,00000000,00000000), ref: 0040DCD7
RtlEnterCriticalSection.NTDLL(0071CC18), ref: 0040DD34
RtlLeaveCriticalSection.NTDLL(0071CC18), ref: 0040DD5D

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID:
API String ID: 975949045-0
Opcode ID: 175fd4d02f368a5b72bf9007b08fe2c66c59b1530e85fe9dcf6726fce75ea158
Instruction ID: f7a0d333f290bcb63a469a2eec1b0008429dfc34ab48aeb1352ed48c01b0074e
Opcode Fuzzy Hash: 175fd4d02f368a5b72bf9007b08fe2c66c59b1530e85fe9dcf6726fce75ea158
Instruction Fuzzy Hash: BB219F70B84708A6DB11BBFE981279E2194DF84744F50843BB404B72C2C9BC8D85DAEE

Function 00405EE3 Relevance: 10.9, APIs: 7, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa9849302e319ab7fc8711118c07f379c778f2085c0dfdc1e9664dff392c48a
Instruction ID: 8bbdc143486be97eeac7d26a8cf1a267e5cbc83b5c072d483e78cd8a83a6f1bd
Opcode Fuzzy Hash: efa9849302e319ab7fc8711118c07f379c778f2085c0dfdc1e9664dff392c48a
Instruction Fuzzy Hash: ADB132B2700A010BE714AA6D9D847AFB382DBC4325F18C23FE615EB3D6DA7C88558759

Function 00408880 Relevance: 10.6, APIs: 7, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408D40: GetCurrentThreadId.KERNEL32 ref: 00408D43

GetTickCount.KERNEL32 ref: 004088B7
GetTickCount.KERNEL32 ref: 004088CF
GetCurrentThreadId.KERNEL32 ref: 004088FE
GetTickCount.KERNEL32 ref: 00408929
GetTickCount.KERNEL32 ref: 00408960
GetTickCount.KERNEL32 ref: 0040898A
GetCurrentThreadId.KERNEL32 ref: 004089FA

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: f2334e8a101f1bafcaa3198c0f83ba998204466cc2e88a435e570baa0cd40851
Instruction ID: f5952a33a39d48c6db27b4604425dfa617615d2cbc6e9a8ef7fef6aacbda8aa0
Opcode Fuzzy Hash: f2334e8a101f1bafcaa3198c0f83ba998204466cc2e88a435e570baa0cd40851
Instruction Fuzzy Hash: 954170716087819ED721AE78C68032FBAD1AB90354F18893ED4D4977C1EE788880CB5B

Function 004099A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099D9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099DF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099FA
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0), ref: 00409A00

Strings

Error, xrefs: 00409A12
Runtime error at 00000000, xrefs: 004099D2, 00409A17

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 93fe03c875f0bd3ed1a4602977ae0cb347907bdf56f00ffee8a10544b1d24375
Instruction ID: 89c4afca87ea43e2bfc7cb94665503eae0742bdb0550a4a04f7d0e40112440e9
Opcode Fuzzy Hash: 93fe03c875f0bd3ed1a4602977ae0cb347907bdf56f00ffee8a10544b1d24375
Instruction Fuzzy Hash: 78F0C2E1795380B9EA1073996C07FAB2698CB44F18F04867FB260780D3C7BC4D848E2E

Function 00406230 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00406252
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00406258
GetStdHandle.KERNEL32(000000F4,0040551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406277
WriteFile.KERNEL32(00000000,000000F4,0040551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040627D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,0040551C,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 00406294
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,0040551C,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 0040629A

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: d562453cc4101579cf982546893c3ff49536c0e2790e623d389f6c32435cff09
Instruction ID: 8c714125e9dd8a7c39ef53a7810cd9c3c21a89630b69638ccc17f63d4b4c23e8
Opcode Fuzzy Hash: d562453cc4101579cf982546893c3ff49536c0e2790e623d389f6c32435cff09
Instruction Fuzzy Hash: C50136A52446107EE500F2AA8C86F9B268CCB54769F10467F7218F61D3C97C5D548A7E

Function 00405964 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00405931), ref: 00405A1B
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00405931), ref: 00405A31
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00405931), ref: 00405A5F
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00405931), ref: 00405A75

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5099269e75e5a6ab0a8e4d3457be39134d42432691f7b2d90439a2de71bb9149
Instruction ID: b812ce8d06ebf4082e90a05f94dbee44063367a31ea6ed9430a006e9869e128f
Opcode Fuzzy Hash: 5099269e75e5a6ab0a8e4d3457be39134d42432691f7b2d90439a2de71bb9149
Instruction Fuzzy Hash: 7CC114B1605B529BC719CF28D98079BBBA0EB85320F18C27FD4559B3D5C778A880CF5A

Function 0040853C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,0071CCE0,0040891F), ref: 0040857F
Sleep.KERNEL32(00000000,0071CCE0,0040891F), ref: 004085A2
SwitchToThread.KERNEL32(0071CCE0,0040891F), ref: 004085A9

Strings

gfff, xrefs: 00408586
gfff, xrefs: 0040855D

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$SwitchThread
String ID: gfff$gfff
API String ID: 695535604-3084402119
Opcode ID: b47aa78fc5970ca9c476efdf6ca05fdfa9f5082f70389fae178afa0706606469
Instruction ID: 195eeacb90887a757dbdc445d824d2a27915f0d9fddd92fe2d27cdfd9ddc0abe
Opcode Fuzzy Hash: b47aa78fc5970ca9c476efdf6ca05fdfa9f5082f70389fae178afa0706606469
Instruction Fuzzy Hash: 81014C70300510DBDB3C593E9E813692182A7D1304F48863FE542ED3C5DE7CD881854F

Function 00405CE8 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405959), ref: 00405D7E
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405959), ref: 00405D98

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: df986b37598149893df31d6b395b0b5c32d2793ceb01fa1d40fa693f7643650f
Instruction ID: 6f2a160053b8c94ac94778ac61a9d38ae9492989bbc59e2be402a58b29ffc70c
Opcode Fuzzy Hash: df986b37598149893df31d6b395b0b5c32d2793ceb01fa1d40fa693f7643650f
Instruction Fuzzy Hash: 8961AC71605A009BD716CB28D989B57BBD0EF85314F18C17FE488AB3D1D7789881CB9A

Function 00409A30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004099A0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099D9
Part of subcall function 004099A0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099DF
Part of subcall function 004099A0: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0,0071CBD0), ref: 004099FA
Part of subcall function 004099A0: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409A58,?,0071CBD0), ref: 00409A00

GetCurrentThreadId.KERNEL32 ref: 00409A68
FreeLibrary.KERNEL32(MZP,00000000), ref: 00409B10
ExitProcess.KERNEL32(00000000), ref: 00409B49

Strings

MZP, xrefs: 00409B0F

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 38d8af313ef954655d5ac438d76b2094b6261915ca78c442cfcc234e5f50a82e
Instruction ID: bcd7e59997be8ce11cdfcb1f86a7e7f6fec42105f83687c416d5ced10ad26c22
Opcode Fuzzy Hash: 38d8af313ef954655d5ac438d76b2094b6261915ca78c442cfcc234e5f50a82e
Instruction Fuzzy Hash: A5319E607042819BDB32ABAA948575B77E0AF49324F14847FE445A63E3D77CDC84CB1E

Function 0040DB58 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040DB69
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040DBC7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040DC24
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040DC57

Part of subcall function 0040DB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040DBD5), ref: 0040DB2B
Part of subcall function 0040DB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040DBD5), ref: 0040DB48

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 78ab3f83260c42738af387752feb6bcfe084c996000fb5efceba4e2e56eaa475
Instruction ID: 86877a9a6bf34754465f865e7404dc4752018dad96b069beb220eabfa0fafc73
Opcode Fuzzy Hash: 78ab3f83260c42738af387752feb6bcfe084c996000fb5efceba4e2e56eaa475
Instruction Fuzzy Hash: 73314174E0421A9BDB10EFE9C8846AEB7B4FF08304F10417AE515E72D1D7789E08CB95

Function 00407130 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 004071A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 004071AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 004071B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 004071E2

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction ID: b4bf5a3cca41a8f436f516690eb6aff6647bd918cefe3464517a4e00ef6805a3
Opcode Fuzzy Hash: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction Fuzzy Hash: C221067298C3842FD7169B208D13B5A7FE4AB86700F0884AFF5859A2D3D67C8A059757

Function 0040716C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 004071A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 004071AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 004071B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 004071E2

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction ID: ae3f43aa8491149d2d6f546a41bfb6d83aae3262c25e5dfafce91d28f80dd080
Opcode Fuzzy Hash: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction Fuzzy Hash: 1201A7716883047AE724AB659C02F9F76D8DFC4B54F00883EB288E61D1D6B889005B56

Function 0040E6E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E7A4,?,MZP,0070BC30), ref: 0040E724
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E7A4,?,MZP,0070BC30), ref: 0040E775

Strings

MZP, xrefs: 0040E6F2

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID: MZP
API String ID: 1159719554-2889622443
Opcode ID: 80fb63d310194b920df1ae50db740cc1d364a33376017cd83e88ceae59973f08
Instruction ID: 8d01cfa91526089f7d99de3be736af0a99f8ff8375d39442d39ee303bd4ab4d7
Opcode Fuzzy Hash: 80fb63d310194b920df1ae50db740cc1d364a33376017cd83e88ceae59973f08
Instruction Fuzzy Hash: 1D116371A4021C9ADB10EA61D896BDE73A8DB48304F1144BAA508B32C1D6785E849E59

Function 00407600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00407604
GetTickCount.KERNEL32 ref: 0040760D

Strings

u@, xrefs: 00407633

Memory Dump Source

Source File: 00000005.00000002.2446612278.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2446612278.000000000071F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2446868389.0000000000775000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CountCounterPerformanceQueryTick
String ID: u@
API String ID: 3881823799-3232061631
Opcode ID: 6c7b9637c60a984526056684cc8a232995170b2b227ed9c91544610274f75141
Instruction ID: 5d037dfbcdb550730f648af8bf7bca3d106284f0ab00c3235f62640660677fab
Opcode Fuzzy Hash: 6c7b9637c60a984526056684cc8a232995170b2b227ed9c91544610274f75141
Instruction Fuzzy Hash: A1E04FB1508A009AD704EB3A890251B72D59EC8364F15CE3AB468D21D4EA389400592A

Analysis Process: LKdayanJELT9QDD900055.exePID: 4476, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	197
Total number of Limit Nodes:	12

Executed Functions

Function 02C3DFBC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,02C3E1E4,?,?,?), ref: 02C3DFFB
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,02C3E1E4,?,?,?), ref: 02C3E044
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,02C3E1E4,?,?,?), ref: 02C3E066
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000), ref: 02C3E084
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002,Software\Embarcadero\Locales,00000000,00020019,?,80000001), ref: 02C3E0A2
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001,Software\CodeGear\Locales,00000000,00020019,?,80000002), ref: 02C3E0C0
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,00020019,?,80000001,Software\Borland\Locales,00000000,00020019,?,80000002,Software\CodeGear\Locales,00000000,00020019,?,80000001), ref: 02C3E0DE
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,02C3E1C0,?,80000001,Software\Embarcadero\Locales,00000000,00020019,?,00000000,02C3E1E4), ref: 02C3E118
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,?,00000000,02C3E1C0,?,80000001), ref: 02C3E13D
RegCloseKey.ADVAPI32(?,02C3E1C7,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,02C3E1C0,?,80000001,Software\Embarcadero\Locales), ref: 02C3E1B8

Strings

Software\CodeGear\Locales, xrefs: 02C3E07A, 02C3E098
Software\Embarcadero\Locales, xrefs: 02C3E03A, 02C3E05C
Software\Borland\Delphi\Locales, xrefs: 02C3E0D4
Software\Borland\Locales, xrefs: 02C3E0B6

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 85eb51bc52d3d5812faaf88ac04a6f689c498aaf6dd7a059585860bf8e0c46f6
Instruction ID: f376f0b3546c4a06d3aa4e42f274d16919bdc1dffd16013dfb50a9709b27426a
Opcode Fuzzy Hash: 85eb51bc52d3d5812faaf88ac04a6f689c498aaf6dd7a059585860bf8e0c46f6
Instruction Fuzzy Hash: A1512371A40319BAFB26D6A4CC81FAEB3BDEF48704F544C65BA05F61C1D6B0AA009F65

Function 02C396A7 Relevance: 6.2, APIs: 4, Instructions: 152
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 02C396CF

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: fe400e43e2b2fd504586230da512bc57f6e57772a2a6aa282dcf524bd94bfe4e
Instruction ID: a8f5c408e58bf7deef2a055d9d51080739bf84aab3189170a1a62138150cf292
Opcode Fuzzy Hash: fe400e43e2b2fd504586230da512bc57f6e57772a2a6aa282dcf524bd94bfe4e
Instruction Fuzzy Hash: 4151BD74A803448FDB27EF68D08479ABBE1BF89358F144E6AD8498B281D7F4D984CF51

Function 02C36510 Relevance: 3.8, APIs: 3, Instructions: 30
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 02C36526
Sleep.KERNEL32(0000000A,00000000), ref: 02C36540
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004), ref: 02C3656F

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$AllocVirtual
String ID:
API String ID: 3510833457-0
Opcode ID: 955dd5fddf2f0b2e370d4add5329bb8a8acabf3428957bbeabb259d5c3328fc0
Instruction ID: f56b0237d89137f081f080d6dc8641d2e1632afa30786950b876e377db43b1fe
Opcode Fuzzy Hash: 955dd5fddf2f0b2e370d4add5329bb8a8acabf3428957bbeabb259d5c3328fc0
Instruction Fuzzy Hash: 9DF05C69ACB38838FB13D630A80A74576C103563DAF601C79D3893D0C4CBE501E5DB56

Function 02C43DC2 Relevance: 3.0, APIs: 2, Instructions: 41
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,?), ref: 02C43DE8
GetProcAddress.KERNEL32(?,00000000), ref: 02C43E0A

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 22393c7a3cef37567af30799d77b3bd8a4b1774f0e4767e30897537a6f2c4157
Instruction ID: 28e3756eb1051016f08c13fef31b36baa044c0e78f5776af05529d9922790de5
Opcode Fuzzy Hash: 22393c7a3cef37567af30799d77b3bd8a4b1774f0e4767e30897537a6f2c4157
Instruction Fuzzy Hash: 3CF09070314288BFEB01EA65CC91AAB77ADDB8D750F6108B1F901D7340DE70AE1099A4

Function 02C44B02 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 02C44B43

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5e3bd612dd479585bf94c02f8782b4eb66b543b3b58d59974b1f50390e189f9e
Instruction ID: 5448e623983d074dd15ebbcc5e7cd740f42ddc347bf18ab0bbce14e76f014ad9
Opcode Fuzzy Hash: 5e3bd612dd479585bf94c02f8782b4eb66b543b3b58d59974b1f50390e189f9e
Instruction Fuzzy Hash: CFF07AB2700118BF9B84DE9DDC80E9BB7ECEB4C2A0B154125BA08D3200D634ED109BB4

Function 02C3D434 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(02C30000,?,00000105), ref: 02C3D452

Part of subcall function 02C3E6E8: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,02C3E7A4,?,02C30000,02F3BC30), ref: 02C3E724
Part of subcall function 02C3E6E8: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,02C3E7A4,?,02C30000,02F3BC30), ref: 02C3E775

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction ID: f14acac20c2d8fd9ed142074755c76f6c5a6bdfcd0254a8a3cf05a46444b6c47
Opcode Fuzzy Hash: 86831261ddfabfcd9bc85f36f3a38433cb8f1aa92be268686a5f39dec9fc441b
Instruction Fuzzy Hash: DBE06D71A013108FCB15DE58C8C0B4633E4AF48760F044951BD54CF34AD371D9108BD0

Function 02C43C5A Relevance: 1.5, APIs: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(?,?,?,?,?), ref: 02C43C72

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4e517a16085b8900b141571b75f19e29287a41f7ed24e47c7e5cc36522aeb123
Instruction ID: b06aa21fabe5a3b07cb902023fc414ef17f826f56b7543f50aeb3c970fab179c
Opcode Fuzzy Hash: 4e517a16085b8900b141571b75f19e29287a41f7ed24e47c7e5cc36522aeb123
Instruction Fuzzy Hash: B3D01273250258AF8700EEBCCC45DAB73DC9718615B148424B918C7100D539E9949B60

Function 02C35644 Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 02C3565B

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf150b1fa7817b9a3e357400eca35425759b02a0074564c2f25017979730847c
Instruction ID: c7dabd34d3d44f79e191f7ae0356de755788b05445e92225e46959c0341395d0
Opcode Fuzzy Hash: bf150b1fa7817b9a3e357400eca35425759b02a0074564c2f25017979730847c
Instruction Fuzzy Hash: 4DF0AFF2FC12018BD7189F789A50742BBE5A748391F11497FE908DBB84E6B088408780

Non-executed Functions

Function 02C3DDBC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 02C3DDD9
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 02C3DDEA
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 02C3DEF8
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 02C3DF0A
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 02C3DF16
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 02C3DF5B

Strings

GetLongPathNameW, xrefs: 02C3DDE4
kernel32.dll, xrefs: 02C3DDD4
\, xrefs: 02C3DF28

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 9b5126694c81aa6455744f36ad7e06e86e87f1136c27c4a219524f42b29783a5
Instruction ID: 6784cf76370ca22bbe4aa5f6cc3cfc561241b1e7629a56a847df2922eb930324
Opcode Fuzzy Hash: 9b5126694c81aa6455744f36ad7e06e86e87f1136c27c4a219524f42b29783a5
Instruction Fuzzy Hash: FF518E31E002089BCB12EAA8CC84B9EB3F6AF88310F544DA4D546E7250EB75EF85CF41

Function 02C43BBA Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c548fbf269681374a4f62cc98c6caf4c17c0801ef128f4977b4fa617319e24
Instruction ID: 1f018ba93180d0a4c3883b29a7276350a25bbfdcb26ca6f53eb566c60796293b
Opcode Fuzzy Hash: 80c548fbf269681374a4f62cc98c6caf4c17c0801ef128f4977b4fa617319e24
Instruction Fuzzy Hash: 40B0927140828ACFC3028B14D490850BFF4BE0328030A45D3C1808F063D330A666CB10

Function 02C44012 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8450fe4c7a004bc0cf51379f90fdac2a70986ec0260150ada95fa7ed2cf788e
Instruction ID: 6c9e4580e8f15034b97eaad2293fa1d5a401c2b78c740b1d8b99b9410a486793
Opcode Fuzzy Hash: b8450fe4c7a004bc0cf51379f90fdac2a70986ec0260150ada95fa7ed2cf788e
Instruction Fuzzy Hash:

Function 02C446BA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dcfa185d17da4a860660270a138e02f8d00b1ec96cc499ba8176a102a0b4bb
Instruction ID: 068a35c341064ca12af39bc4aedca1a590f4a3659a2da41402558830284b8dcb
Opcode Fuzzy Hash: c4dcfa185d17da4a860660270a138e02f8d00b1ec96cc499ba8176a102a0b4bb
Instruction Fuzzy Hash:

Function 02C444A2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaa91a2c78d761e734fe74f431eb65c85573f40cbc1ac68461a02280131c288
Instruction ID: cd86da38a477c09d30418af20f6c1120dade302ce650930a404cf64d57d396b8
Opcode Fuzzy Hash: cbaa91a2c78d761e734fe74f431eb65c85573f40cbc1ac68461a02280131c288
Instruction Fuzzy Hash:

Function 02C445E2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e824c62572e76e9ad0e78500f027f9821698502f2fab115f59bee5619807f2
Instruction ID: 5d0a556ba0dcc4fed73697c915312e8220406461742b259a84b60162e5059f4a
Opcode Fuzzy Hash: 63e824c62572e76e9ad0e78500f027f9821698502f2fab115f59bee5619807f2
Instruction Fuzzy Hash:

Function 02C4458A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8da95b396dedb53e7a66ba54227d60fcb9aa44f717ecfe36554d25d57519ace
Instruction ID: e1838f9bbfce86f5057186470c69c324b497fe5917a01da8b4223997e1a29a03
Opcode Fuzzy Hash: d8da95b396dedb53e7a66ba54227d60fcb9aa44f717ecfe36554d25d57519ace
Instruction Fuzzy Hash:

Function 02C44AEA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ca92915643164b63ed2a2e2ee00f2d16f2440702417b286864a221eb713f60
Instruction ID: ea4a30a6ce9c8a4101eb93cbaf808ee47cb32894e831164607e801fb5b9112fd
Opcode Fuzzy Hash: 29ca92915643164b63ed2a2e2ee00f2d16f2440702417b286864a221eb713f60
Instruction Fuzzy Hash:

Function 02C44AF2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca2bbf78e6caa4e5dde827ef92a682c21d194c1a178adee509eca235b5b070b
Instruction ID: 4058c51f3221412a2e4e2e94085c23a22ffacf82b03366b08db63bf320c79051
Opcode Fuzzy Hash: 1ca2bbf78e6caa4e5dde827ef92a682c21d194c1a178adee509eca235b5b070b
Instruction Fuzzy Hash:

Function 02C448D2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ec7f1de70b1c8ed8979ca55b68f91c75517e9e2737bd67719a1b03ce5ce9ac
Instruction ID: c5ce4e5c3954d419612948e2478b14f0169788de5dcbcd39dbd4ca5713125f57
Opcode Fuzzy Hash: 84ec7f1de70b1c8ed8979ca55b68f91c75517e9e2737bd67719a1b03ce5ce9ac
Instruction Fuzzy Hash:

Function 02C44832 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4314fd54ad591aa27acab35990dd943f7c92b8df23ad16efb69bf373706e87f
Instruction ID: 522ea8a83e0c9aa4d39afd1511bf22fe31e1a755c230263edc441ebe2eeda891
Opcode Fuzzy Hash: b4314fd54ad591aa27acab35990dd943f7c92b8df23ad16efb69bf373706e87f
Instruction Fuzzy Hash:

Function 02C4499A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0807e8b14f2aed1a64b374024007f79195a8235af6c750e206e353ad867e85
Instruction ID: bab6ed2377732ac2a99d29319a32b60ab4a90350b07ce112ae6868b3d8d9db6f
Opcode Fuzzy Hash: 8d0807e8b14f2aed1a64b374024007f79195a8235af6c750e206e353ad867e85
Instruction Fuzzy Hash:

Function 02C43E9A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927cb1af9b406d3e236e30b2d2026bd39a6d5d3aeefa6d1e0ddf5d0d68e5489a
Instruction ID: bda66259d659b9e25a5c7ed35943a18cca0bf74f5b7f817920a7fcc4fa50d9b1
Opcode Fuzzy Hash: 927cb1af9b406d3e236e30b2d2026bd39a6d5d3aeefa6d1e0ddf5d0d68e5489a
Instruction Fuzzy Hash:

Function 02C43D5A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec926e8996012fd6917f61cb63b1d24fcc3d3dfced0482a75532febaaf8d7ae0
Instruction ID: b2a913a453d0134c0bb3effb637bd60e29076756e61bc320e76b0c77b278cb01
Opcode Fuzzy Hash: ec926e8996012fd6917f61cb63b1d24fcc3d3dfced0482a75532febaaf8d7ae0
Instruction Fuzzy Hash:

Function 02C37048 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 80
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 02C37065
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02C3706B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C3707E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C3708B
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C3709F
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 02C370A5
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C370C3
GetProcessHeap.KERNEL32(00000000,?,02C37127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C37112
HeapFree.KERNEL32(00000000,00000000,?,02C37127,+!,?,00000000,00000000,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C37118

Strings

kernel32.dll, xrefs: 02C37060
GetLogicalProcessorInformation, xrefs: 02C3705B
+!, xrefs: 02C370B0

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Heap$InformationLogicalProcessProcessor$AddressAllocateErrorFreeHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll$+!
API String ID: 3837757292-3207784131
Opcode ID: 437e3bb8be599872a044802a5813df387d8f0ef47721ddac5d7d1556d5a63c83
Instruction ID: 7d0e875eb96c23787ade816f8313180b0bcca8967a1d960cd2bb9aa2e74dccc7
Opcode Fuzzy Hash: 437e3bb8be599872a044802a5813df387d8f0ef47721ddac5d7d1556d5a63c83
Instruction Fuzzy Hash: 5121B3B2E04208AFEB52DBE4CD80B5EF3FAEB88310F5088A5E508D7141D7B596449F50

Function 02C44BB4 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryclipboardwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32(MouseZ,Magellan MSWHEEL), ref: 02C44BCC
RegisterClipboardFormatW.USER32(MSWHEEL_ROLLMSG), ref: 02C44BD8
RegisterClipboardFormatW.USER32(MSH_WHEELSUPPORT_MSG), ref: 02C44BE7
RegisterClipboardFormatW.USER32(MSH_SCROLL_LINES_MSG), ref: 02C44BF3
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 02C44C0B
SendMessageW.USER32(00000000,?,00000000,00000000), ref: 02C44C2F

Strings

MouseZ, xrefs: 02C44BC7
MSH_SCROLL_LINES_MSG, xrefs: 02C44BEE
MSH_WHEELSUPPORT_MSG, xrefs: 02C44BE2
Magellan MSWHEEL, xrefs: 02C44BC2
MSWHEEL_ROLLMSG, xrefs: 02C44BD3

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 296d381b120491d993726e29ab65d20e4171d0bc8298840f7acc785637eb4f54
Instruction ID: 73808b42ea4c3e9a25c98bd04e2ddeeaf9160a97f98f69c0794c659a84b3b0c7
Opcode Fuzzy Hash: 296d381b120491d993726e29ab65d20e4171d0bc8298840f7acc785637eb4f54
Instruction Fuzzy Hash: 64112A70240706EFF7289FA5D882B67B7ADEF54750F384025E9819B240EFB09A40DB74

Function 02C38610 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 02C38625
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 02C3862B
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C3863E
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C3864B
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,02C386C4,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 02C38676

Strings

kernel32.dll, xrefs: 02C38620
@, xrefs: 02C386CB
GetLogicalProcessorInformation, xrefs: 02C3861B

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: b37dbefea8ec48b8bbc1fa069d772bc2c17341de84308b21ecff0eaf6821fb49
Instruction ID: bb4707d307d85838cffa25e304e6bce2b293dd86e86468f3231f999e507d68a4
Opcode Fuzzy Hash: b37dbefea8ec48b8bbc1fa069d772bc2c17341de84308b21ecff0eaf6821fb49
Instruction Fuzzy Hash: CC118EB0D00208AFEB12EBA4C945BAEB7F9EF44714F108DA5F815D7291D7799A80CF51

Function 02C40975 Relevance: 13.8, APIs: 9, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02C40A2C

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a013d5377c02056dd93a9ad6ac1f790d77b47d895bdbfc4da4743d6f8767c692
Instruction ID: 94a73d56d67a24b0afc619211d21a00ec43b1b4b9a870ffe4ec8757e04e5afcf
Opcode Fuzzy Hash: a013d5377c02056dd93a9ad6ac1f790d77b47d895bdbfc4da4743d6f8767c692
Instruction Fuzzy Hash: 87A16EB5E807099FDB28CFA4D880BAFB7B5BB88354F14451AEA05A7280DB709A45CF54

Function 02C3DC74 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02F4CC18), ref: 02C3DC92
RtlLeaveCriticalSection.NTDLL(02F4CC18), ref: 02C3DCB6
RtlLeaveCriticalSection.NTDLL(02F4CC18), ref: 02C3DCC5
IsValidLocale.KERNEL32(00000000,00000002,02F4CC18,02F4CC18,00000000,02C3DD7A,?,?,?,00000000,?,02C3E67A,00000000,02C3E6DB), ref: 02C3DCD7
RtlEnterCriticalSection.NTDLL(02F4CC18), ref: 02C3DD34
RtlLeaveCriticalSection.NTDLL(02F4CC18), ref: 02C3DD5D

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID:
API String ID: 975949045-0
Opcode ID: 70aacc39520d4cfa8aef1b37a412ee42d39cbc798bd6db7cca018c60053911f0
Instruction ID: 15da1a3924c2321bee9ba77caac5a458c5ae9e76be3dd9d25a4825094538011c
Opcode Fuzzy Hash: 70aacc39520d4cfa8aef1b37a412ee42d39cbc798bd6db7cca018c60053911f0
Instruction Fuzzy Hash: AA21D57075438856EB13B779980175D368B9B89B80F904C22E243D7260CEE18F40EFE2

Function 02C35EE3 Relevance: 10.9, APIs: 7, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f432bd865fe22f6426bcd871d001a91f9ae8717faac0b0169bef0c11ce2513
Instruction ID: dbe5bb53258c6552454f54b25517a821a7f7cd3e6f859727bd361a8daf29d7c6
Opcode Fuzzy Hash: d3f432bd865fe22f6426bcd871d001a91f9ae8717faac0b0169bef0c11ce2513
Instruction Fuzzy Hash: E1B16BB2B403045BE7169A7CDC8476DB3C6DBC83A5F688A3DE214CB385DB75C9458394

Function 02C38880 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C38D40: GetCurrentThreadId.KERNEL32 ref: 02C38D43

GetTickCount.KERNEL32 ref: 02C388B7
GetTickCount.KERNEL32 ref: 02C388CF
GetCurrentThreadId.KERNEL32 ref: 02C388FE
GetTickCount.KERNEL32 ref: 02C38929
GetTickCount.KERNEL32 ref: 02C38960
GetTickCount.KERNEL32 ref: 02C3898A
GetCurrentThreadId.KERNEL32 ref: 02C389FA

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: a460127445a0502263e1a9823e9afd217d39204053272ff21d4992d4488dc4b7
Instruction ID: 205860244881f6e2329856e984a1a1c18869fd5effbd9796741cab27f4217988
Opcode Fuzzy Hash: a460127445a0502263e1a9823e9afd217d39204053272ff21d4992d4488dc4b7
Instruction Fuzzy Hash: 73416D716083819ED722EE7CC48836EBAD1AFC4354F198E2DE4D887281EBB49584DB53

Function 02C399A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02C39A58,?,02F4CBD0,02F4CBD0), ref: 02C399D9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02C39A58,?,02F4CBD0,02F4CBD0), ref: 02C399DF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02C39A58,?,02F4CBD0,02F4CBD0), ref: 02C399FA
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,02C39A58,?,02F4CBD0), ref: 02C39A00

Strings

Runtime error at 00000000, xrefs: 02C399D2, 02C39A17
Error, xrefs: 02C39A12

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: ad1e802ab6becaacc1a7f6ec2fc44e9a954aef89067798591efd905eb1949e8f
Instruction ID: 02cc4c0540f533ed9952b858ac531bc518d9a8a4a005a2fc3dda15ef2c9322c8
Opcode Fuzzy Hash: ad1e802ab6becaacc1a7f6ec2fc44e9a954aef89067798591efd905eb1949e8f
Instruction Fuzzy Hash: 6DF084A4AC434438FA13B3649C26F6A778CA388F98F400E09F210A80C1D7F189C0AF62

Function 02C36230 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 02C36252
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 02C36258
GetStdHandle.KERNEL32(000000F4,02C3551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 02C36277
WriteFile.KERNEL32(00000000,000000F4,02C3551C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 02C3627D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,02C3551C,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 02C36294
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,02C3551C,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 02C3629A

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 1e9ae353639d3bce05c72ef11ebe3386e1eed9612eb0515d15a5a8494b5291f8
Instruction ID: 6db1e532d32ad5bc66dedf67219263396b305f3f1fd2ea5c069faf6968de7989
Opcode Fuzzy Hash: 1e9ae353639d3bce05c72ef11ebe3386e1eed9612eb0515d15a5a8494b5291f8
Instruction Fuzzy Hash: 9401C8A52842147EE502F2A8CC85F5F3B8D9B4C7B5F504E11721CF20C1C9A09D10ABB1

Function 02C35964 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,02C35931), ref: 02C35A1B
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,02C35931), ref: 02C35A31
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,02C35931), ref: 02C35A5F
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,02C35931), ref: 02C35A75

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9b93f9de284187308e0cee6f8d6cac5d1738bac8cabb2838ca4a713b97c9cb85
Instruction ID: 2756aadb1af3feae1465edb11cd2b73d1c87ae14aa5769db1a22528a8c44db8e
Opcode Fuzzy Hash: 9b93f9de284187308e0cee6f8d6cac5d1738bac8cabb2838ca4a713b97c9cb85
Instruction Fuzzy Hash: 30C18CB1A817418FC71BCF28E490755FBE1BB9D3A8F488E6ED0558B381D3B09591C790

Function 02C3853C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,02F4CCE0,02C3891F), ref: 02C3857F
Sleep.KERNEL32(00000000,02F4CCE0,02C3891F), ref: 02C385A2
SwitchToThread.KERNEL32(02F4CCE0,02C3891F), ref: 02C385A9

Strings

gfff, xrefs: 02C3855D
gfff, xrefs: 02C38586

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep$SwitchThread
String ID: gfff$gfff
API String ID: 695535604-3084402119
Opcode ID: 8ce1d54102f9a58a27e7cca86923bcb4cec12a03df11cf12a2f7d13f92bf6199
Instruction ID: 142ca6e170ee59714f6b8c5b8260437504488c51f82ce5bd246deb683677f2cd
Opcode Fuzzy Hash: 8ce1d54102f9a58a27e7cca86923bcb4cec12a03df11cf12a2f7d13f92bf6199
Instruction Fuzzy Hash: 840184B27441158BFB7E993DA8807283293A7C5701F884F25F506CE3C8DBA5D5419683

Function 02C35CE8 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02C35959), ref: 02C35D7E
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02C35959), ref: 02C35D98

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1578a3acd90885efa9329d8fb5dc0bd1aff3c3ec39af9d7ba45a23d9d0e95415
Instruction ID: 76e6763ffc74bbd60480d2fbcbd3f5c5c979535b9de101a9697f8edad749fedb
Opcode Fuzzy Hash: 1578a3acd90885efa9329d8fb5dc0bd1aff3c3ec39af9d7ba45a23d9d0e95415
Instruction Fuzzy Hash: F06105716453408FD71BCF28CA88B56BBD1EF8D394F988D6ED4888B391D7B09981CB51

Function 02C3DB58 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 02C3DB69
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 02C3DBC7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 02C3DC24
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 02C3DC57

Part of subcall function 02C3DB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,02C3DBD5), ref: 02C3DB2B
Part of subcall function 02C3DB14: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,02C3DBD5), ref: 02C3DB48

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: d57df97211933d2464d91c45da028d59f2b9e689f0d95f6487ec6ccb5bc0b8b8
Instruction ID: 0529732a9bc8e28e4bf631b3297a82bc51c091a8104a853b1a070e0f290173a9
Opcode Fuzzy Hash: d57df97211933d2464d91c45da028d59f2b9e689f0d95f6487ec6ccb5bc0b8b8
Instruction Fuzzy Hash: 07315E70E0021E9BDB11EFE5D8846EEB7F9FF44304F104965E512E7290DBB49A04DB91

Function 02C37130 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 02C371A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 02C371AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 02C371B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 02C371E2

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction ID: 8f294ee57756a219a99a8abd5e79c3073c380249bb6cb0f954b09d2295602563
Opcode Fuzzy Hash: 811eb2c03c4d562095ff2db9b9de25a2ab2495e7e687e6fbbc9ac6ab73b4b4d6
Instruction Fuzzy Hash: 89210AB258C3C02FD7179B208D12B5DBFE5AB86700F08899FE189CB1D3D77586099B52

Function 02C3716C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 02C371A3
VerSetConditionMask.NTDLL(00000000,?,00000000,00000000), ref: 02C371AA
VerSetConditionMask.NTDLL(00000000,?,00000000), ref: 02C371B1
VerifyVersionInfoW.KERNEL32(?,00000023,?,?), ref: 02C371E2

Memory Dump Source

Source File: 00000008.00000002.2035773364.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000008.00000002.2035773364.0000000002F4F000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2036130753.0000000002FA5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_LKdayanJELT9QDD900055.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction ID: 8e46627206701365582492b3aa94d48ebb1db3dff938fc5494c95e4fc2e9d42e
Opcode Fuzzy Hash: fb8912d6d8db4d105f5749ad0421f6c16bcd7ef8cb1966a2e240765e008cbf96
Instruction Fuzzy Hash: 5C01DB716883047BE725AB64DC02F9F76D9DFC8B50F008C2DB28CD71D0D6B589005B52

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HomeDesk.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\53da31.rbs

C:\Users\user\Nota Fiscal Eletronica\AGLoader.dll

C:\Users\user\Nota Fiscal Eletronica\LKdayanJELT9QDD900055.exe

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv0.2.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.2.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv1.3.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv10.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv10.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv11.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv11.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv12.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv12.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv13.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv13.1.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv14.0.tv

C:\Users\user\Nota Fiscal Eletronica\iframe\rolloutfile.tv14.1.tv

Windows Analysis Report
HomeDesk.msi

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre