Edit tour

Windows Analysis Report
0438.pdf.exe

Overview

General Information

Sample name:	0438.pdf.exe renamed because original name is a hash value
Original sample name:	.pdf.exe
Analysis ID:	1545741
MD5:	2d11dba46735af1cb1c0a42e9564e20d
SHA1:	b2e17960c6d080f7aba7df87f57c08b4bc2e7051
SHA256:	e19477a56b247e6cc435fee367abcf6e0c3db21de91ae2514b4a6b1807233c53
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Enables network access during safeboot for specific services

Enables remote desktop connection

Initial sample is a PE file and has a suspicious name

Uses an obfuscated file name to hide its real file extension (double extension)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0438.pdf.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\0438.pdf.exe" MD5: 2D11DBA46735AF1CB1C0A42E9564E20D)

msiexec.exe (PID: 7520 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

Acrobat.exe (PID: 7540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7816 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1604,i,14248424182564037547,2314373854622466325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

msiexec.exe (PID: 7584 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

ROMFUSClient.exe (PID: 6244 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 7220 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8260 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8296 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8316 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8356 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start MD5: F3D74B072B9697CF64B0B8445FDC8128)

svchost.exe (PID: 7888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ROMServer.exe (PID: 8372 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8516 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8528 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.ROMServer.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
8.0.ROMFUSClient.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0438.pdf.exe", CommandLine: "C:\Users\user\Desktop\0438.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\0438.pdf.exe, NewProcessName: C:\Users\user\Desktop\0438.pdf.exe, OriginalFileName: C:\Users\user\Desktop\0438.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\0438.pdf.exe", ProcessId: 7428, ProcessName: 0438.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.90.140.76, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Initiated: true, ProcessId: 8372, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 56363

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7888, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0438.pdf.exe

ReversingLabs: Detection: 44%

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: 0438.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C044B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6C044B190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04340BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6C04340BC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C045FCA0 FindFirstFileExA,	0_2_00007FF6C045FCA0

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 111.90.140.76 ports 5651,8080,1,465,5,6,80

Enables network access during safeboot for specific services

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry value created: NULL Service

Source: global traffic	TCP traffic: 192.168.2.4:56360 -> 111.90.140.76:5651
Source: global traffic	TCP traffic: 192.168.2.4:56365 -> 65.21.245.7:5555

Source: Joe Sandbox View	IP Address: 96.7.168.138 96.7.168.138
Source: Joe Sandbox View	IP Address: 65.21.245.7 65.21.245.7

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: AledensoftIpcServer.dll.3.dr, ROMwln.dll.3.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000005.00000002.3369539538.0000024EF0600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF04A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF04A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF04A8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF04DD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 503872.rbs.3.dr, Turkish.lg.3.dr, ROMFUSClient.exe.3.dr	String found in binary or memory: http://litemanager.com/
Source: ROMFUSClient.exe, 00000011.00000002.3565595344.0000000002803000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03
Source: ROMServer.exe, 0000000E.00000002.3565595494.0000000001693000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03i
Source: ROMFUSClient.exe, 00000011.00000002.3565595344.00000000027FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/1
Source: ROMFUSClient.exe, 00000008.00000000.1782110715.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1791801540.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Ukrainian.lg.3.dr, Russian.lg.3.dr, ROMFUSClient.exe.3.dr	String found in binary or memory: http://litemanager.ru/
Source: Ukrainian.lg.3.dr	String found in binary or memory: http://litemanager.ru/forum/ru/memberlist.php?mode=viewprofile&u=977.
Source: ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://litemanager.ru/noip.txtU
Source: AledensoftIpcServer.dll.3.dr, ROMwln.dll.3.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 503872.rbs.3.dr	String found in binary or memory: http://www.LiteManagerTeam.com
Source: ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMFUSClient.exe, 00000008.00000003.1800618576.00000000028D7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000009.00000003.1793938281.0000000002947000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000A.00000003.1810819906.00000000028A7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000B.00000003.1809303676.0000000002997000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000C.00000003.1846423065.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000D.00000003.1842258416.0000000002AA7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000E.00000002.3565595494.00000000015F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000002.3565165709.0000000002757000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000011.00000002.3565595344.0000000002767000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe.3.dr	String found in binary or memory: http://www.indyproject.org/
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF0552000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF0552000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe.3.dr	String found in binary or memory: https://litemanager.com/romversion.txt
Source: ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe.3.dr	String found in binary or memory: https://litemanager.com/soft/pro/ROMServer.zip
Source: svchost.exe, 00000005.00000003.1714090201.0000024EF0552000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: ROMFUSClient.exe.3.dr	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 56266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56266

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 0438.pdf.exe

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C042C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6C042C2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\503870.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D90.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\503873.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\503873.msi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\503873.msi

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C044B190	0_2_00007FF6C044B190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0443484	0_2_00007FF6C0443484
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043A4AC	0_2_00007FF6C043A4AC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0450754	0_2_00007FF6C0450754
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0434928	0_2_00007FF6C0434928
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C042F930	0_2_00007FF6C042F930
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0425E24	0_2_00007FF6C0425E24
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C044CE88	0_2_00007FF6C044CE88
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0441F20	0_2_00007FF6C0441F20
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043F180	0_2_00007FF6C043F180
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04421D0	0_2_00007FF6C04421D0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0427288	0_2_00007FF6C0427288
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043126C	0_2_00007FF6C043126C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C042A310	0_2_00007FF6C042A310
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C042C2F0	0_2_00007FF6C042C2F0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04453F0	0_2_00007FF6C04453F0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043B534	0_2_00007FF6C043B534
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0462550	0_2_00007FF6C0462550
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04276C0	0_2_00007FF6C04276C0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C045C838	0_2_00007FF6C045C838
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0424840	0_2_00007FF6C0424840
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04589A0	0_2_00007FF6C04589A0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043C96C	0_2_00007FF6C043C96C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0443964	0_2_00007FF6C0443964
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C045FA94	0_2_00007FF6C045FA94
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0442AB0	0_2_00007FF6C0442AB0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0421AA4	0_2_00007FF6C0421AA4
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0431A48	0_2_00007FF6C0431A48
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0465AF8	0_2_00007FF6C0465AF8
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043BB90	0_2_00007FF6C043BB90
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0444B98	0_2_00007FF6C0444B98
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0435B60	0_2_00007FF6C0435B60
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0458C1C	0_2_00007FF6C0458C1C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0442D58	0_2_00007FF6C0442D58
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0448DF4	0_2_00007FF6C0448DF4
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0450754	0_2_00007FF6C0450754
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C043AF18	0_2_00007FF6C043AF18
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0462080	0_2_00007FF6C0462080

Source: ROMViewer.exe.3.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe.3.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe0.3.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: ROMServer.exe0.3.dr	Static PE information: Number of sections : 11 > 10
Source: ROMServer.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: ROMViewer.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: ROMFUSClient.exe.3.dr	Static PE information: Number of sections : 11 > 10

Source: ROMViewer.exe.3.dr

Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfmEditBinaryValue'

Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE706000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE672000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE672000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.1699116379.000001C7FA729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe

Source: classification engine

Classification label: mal76.troj.evad.winEXE@37/92@1/4

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C042B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6C042B6D8

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C0448624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF6C0448624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSLocal
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSTray

Source: C:\Users\user\Desktop\0438.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5256140

Jump to behavior

Source: Yara match	File source: 9.0.ROMServer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.ROMFUSClient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, type: DROPPED

Source: 0438.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\0438.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0438.pdf.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\0438.pdf.exe

File read: C:\Users\user\Desktop\0438.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0438.pdf.exe "C:\Users\user\Desktop\0438.pdf.exe"
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1604,i,14248424182564037547,2314373854622466325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1604,i,14248424182564037547,2314373854622466325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray

Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll

Source: C:\Users\user\Desktop\0438.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Start LM-Server.lnk.3.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Uninstall LiteManager - Server.lnk.3.dr	LNK file: ..\..\..\..\..\..\Windows\SysWOW64\msiexec.exe
Source: Stop LM-Server.lnk.3.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Settings for LM-Server.lnk.3.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0438.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0438.pdf.exe

Static file information: File size 11654747 > 1048576

Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0438.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0438.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe

Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0438.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5256140

Jump to behavior

Source: 0438.pdf.exe	Static PE information: section name: .didat
Source: 0438.pdf.exe	Static PE information: section name: _RDATA
Source: ROMViewer.exe.3.dr	Static PE information: section name: .didata
Source: ROMFUSClient.exe.3.dr	Static PE information: section name: .didata
Source: ROMwln.dll.3.dr	Static PE information: section name: .didata
Source: ROMServer.exe.3.dr	Static PE information: section name: .didata
Source: HookDrv.dll.3.dr	Static PE information: section name: .didata
Source: ROMServer.exe0.3.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0465166 push rsi; retf		0_2_00007FF6C0465167
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0465156 push rsi; retf		0_2_00007FF6C0465157

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\romserver.exe

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 0438.pdf.exe

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\LiteManager\v3.4\Server\Parameters NoIPSettings

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 2446
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 7442

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 7976	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8212	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 9120	Thread sleep count: 60 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 8608	Thread sleep time: -1223000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 8608	Thread sleep time: -3721000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C044B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6C044B190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04340BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6C04340BC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C045FCA0 FindFirstFileExA,	0_2_00007FF6C045FCA0

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C04516A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6C04516A4

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: ROMFUSClient.exe, 0000000C.00000002.1851645963.0000000000DF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ROMFUSClient.exe, 00000008.00000003.1801349752.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: svchost.exe, 00000005.00000002.3368919494.0000024EEB02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3369679294.0000024EF065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ROMFUSClient.exe, 00000008.00000003.1801349752.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ROMServer.exe, 0000000E.00000002.3564893821.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000002.3563770467.0000000000B39000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000011.00000002.3563690116.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C0453170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6C0453170

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C0460D20 GetProcessHeap,

0_2_00007FF6C0460D20

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0453170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6C0453170
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0453354 SetUnhandledExceptionFilter,	0_2_00007FF6C0453354
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C0452510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6C0452510
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF6C04576D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6C04576D8

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C044B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6C044B190

Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C04658E0 cpuid

0_2_00007FF6C04658E0

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF6C044A2CC

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C0450754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6C0450754

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF6C04351A4 GetVersionExW,

0_2_00007FF6C04351A4

Remote Access Functionality

Enables remote desktop connection

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server AllowRemoteRPC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Windows Service	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	122 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0438.pdf.exe	45%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	3%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://litemanager.ru/	ROMFUSClient.exe, 00000008.00000000.1782110715.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1791801540.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Ukrainian.lg.3.dr, Russian.lg.3.dr, ROMFUSClient.exe.3.dr	false		unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.4.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	ROMFUSClient.exe.3.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	ROMFUSClient.exe.3.dr	false		unknown
https://litemanager.com/romversion.txt	ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe.3.dr	false		unknown
http://litemanager.com/03i	ROMServer.exe, 0000000E.00000002.3565595494.0000000001693000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	ROMFUSClient.exe.3.dr	false	URL Reputation: safe	unknown
http://litemanager.ru/forum/ru/memberlist.php?mode=viewprofile&u=977.	Ukrainian.lg.3.dr	false		unknown
http://ocsp.thawte.com0	0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://litemanager.ru/noip.txtU	ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false		unknown
http://crl.ver)	svchost.exe, 00000005.00000002.3369539538.0000024EF0600000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.5.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	ROMFUSClient.exe.3.dr	false	URL Reputation: safe	unknown
http://www.LiteManagerTeam.com	503872.rbs.3.dr	false		unknown
http://www.indyproject.org/	ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMFUSClient.exe, 00000008.00000003.1800618576.00000000028D7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000009.00000003.1793938281.0000000002947000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000A.00000003.1810819906.00000000028A7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000B.00000003.1809303676.0000000002997000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000C.00000003.1846423065.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000D.00000003.1842258416.0000000002AA7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000E.00000002.3565595494.00000000015F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000002.3565165709.0000000002757000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000011.00000002.3565595344.0000000002767000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe.3.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	ROMFUSClient.exe.3.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://litemanager.com/1	ROMFUSClient.exe, 00000011.00000002.3565595344.00000000027FC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.5.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	ROMFUSClient.exe.3.dr	false		unknown
https://litemanager.com/soft/pro/ROMServer.zip	ROMFUSClient.exe, 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe.3.dr	false		unknown
http://litemanager.com/03	ROMFUSClient.exe, 00000011.00000002.3565595344.0000000002803000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.5.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000005.00000003.1714090201.0000024EF0552000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6EC000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.1694197998.000001C7FE6AE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	ROMFUSClient.exe.3.dr	false		unknown
http://litemanager.com/	503872.rbs.3.dr, Turkish.lg.3.dr, ROMFUSClient.exe.3.dr	false		unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000005.00000003.1714090201.0000024EF0552000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	ROMFUSClient.exe.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States	262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false
111.90.140.76	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
65.21.245.7	unknown	United States	199592	CP-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545741
Start date and time:	2024-10-30 22:45:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0438.pdf.exe renamed because original name is a hash value
Original Sample Name:	.pdf.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@37/92@1/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.19.126.149, 2.19.126.143, 52.5.13.197, 52.202.204.11, 23.22.254.206, 54.227.187.23, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.23.197.184, 23.32.184.135, 93.184.221.240, 2.19.11.122, 2.19.11.117
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, wu.azureedge.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 0438.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
17:46:54	API Interceptor	75177x Sleep call for process: ROMFUSClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
96.7.168.138	401K .pdf	Get hash	malicious	HTMLPhisher	Browse
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse
	tue.bat	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	Get hash	malicious	Unknown	Browse
111.90.140.76	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
65.21.245.7	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	101.99.93.169
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	111.90.140.76
	b.cmd	Get hash	malicious	Unknown	Browse	101.99.92.203
INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	401K .pdf	Get hash	malicious	HTMLPhisher	Browse	96.7.168.138
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse	96.7.168.138
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	96.7.168.138
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	200.220.206.173
	tue.bat	Get hash	malicious	Unknown	Browse	96.7.168.138
CP-ASDE	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	65.21.245.7
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	65.21.245.7
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	65.21.196.90

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\503872.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	25210
Entropy (8bit):	5.137975751443757
Encrypted:	false
SSDEEP:	384:6S75t8t+CqZ+oNbynfBytjj3ItCgCVOVv:6S1t8t+CqZ+oNbynfEtItpAMv
MD5:	932E9DB62A7E4BB81C9A0D77523E1C6F
SHA1:	4D62330936B1B90BE5332F82619234FD11550A9F
SHA-256:	A02435E5F86ED1D73B632A072C845AFF1E4DC63ABEC3801DFCBC31D6E068794B
SHA-512:	AC400FF7B88AAA80E2F83F65C28AECF8A92B415E138055CD9D63CB93ED682E50874B3DAF6D61F56914AB1CD5CA9EC74902C0257B8E063A6241DC17B15286A53B
Malicious:	false
Preview:	...@IXOS.@.....@.^Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..pdf.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3244CDE6-6414-4399-B0D5-424562747210}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{A3DC5A2F-2249-4674-B

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132032
Entropy (8bit):	6.10195829980833
Encrypted:	false
SSDEEP:	3072:sh/1J7RYdzZU4Z5tegH1q888888888888W888888888882zgP:sh/jIZPZ5tJ8888888888888W888888s
MD5:	C40455A478E0B76521130D9DAAAADC4B
SHA1:	42DE923D5E36A9F56B002DD66DB245BC44480089
SHA-256:	308085BC357BF3A3BEE0D662FCC01628E9EE2FFD478AE0F1E7140939AD99B892
SHA-512:	76ED6D763F603BCAA7FE186C0A7449E614DCDB18036F7587C6E5A11C3F3269E400E3D2062856CC280AC20C094617924783B6C360F25AF66767DCC53C2F3045C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gBYz86HSwI.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....xK............................p........ ..........................................................................\.......\...............................x#...................................................................................text...$........................... ..`.itext.............................. ..`.data...0.... ......................@....bss....xN...@...........................idata..\...........................@....edata..\............&..............@..@.reloc..x#.......$...(..............@..B.rsrc................L..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default language ID 1049
Category:	dropped
Size (bytes):	58679
Entropy (8bit):	4.738446173390891
Encrypted:	false
SSDEEP:	768:bkJC7UF9eVWSlBY8Aq9CBGDtD8gX1ZDCZjewbAsCw1vPDQuJPQzusxxeCNHnPPsT:htwqueMZYU
MD5:	BAED4E7AF33F77350D454B69317EE63B
SHA1:	2B598774F0C73850A36117F29EA8DAC57BE1C138
SHA-256:	671D65183C39E53FC1759C45B105A0FBE2D3A216E4099B66D5FCF274EA625E07
SHA-512:	E740997BDECB8F907A000D01BF3E823898A1289D1DBFAE5BF342D4BCB6FF09D258317955F4FD858FF6B239E5BA08E49E90CDEC06E24DABDB18C1CF2D8943590C
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1251\uc1\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049{\fonttbl{\f0\froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f211\froman\fcharset0\fprq2 Times New Roman{\\falt Times New Roman};}..{\f209\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times New Roman};}{\f212\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times New Roman};}{\f213\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Times New Roman};}..{\f214\froman\fcharset177\fprq2 Times New Roman (Hebrew){\\falt Times New Roman};}{\f215\froman\fcharset178\fprq2 Time

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	89220
Entropy (8bit):	3.469297258214741
Encrypted:	false
SSDEEP:	768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
MD5:	B1C96EF24061BF294CAC6C4C9CBF7757
SHA1:	5D1B1934091E257B5F1C69B13F5FC1E424348584
SHA-256:	20DB884523DA62C20F80B8A3BB71E11091B90A443B83C06D8FE2A1BBC00C1C33
SHA-512:	6E90562FD804F91DDADEF2310551063D34B859FF1CC6E58A41667E9CDA062DCA851C8455882EF47CF3E1A8EC21EBD9F0761F15E54174CC4A95427238CB39BA14
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.3.3.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .Q.u.e.s.t.i.o.n.....e.r.r.o.r. .=. .E.r.r.o.r.....i.n.f.o.r.m.a.t.i.o.n. .=. .I.n.f.o.r.m.a.t.i.o.n.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .N.o.t.i.f.i.c.a.t.i.o.n.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .C.a.n. .n.o.t. .r.e.a.d. .s.e.r.v.i.c.e. .c.o.n.f.i.g.u.r.a.t.i.o.n...\.n.;.R.e.i.n.s.t.a.l.l. .L.i.t.e.M.a.n.a.g.e.r. .s.e.r.v.i.c.e.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e...\.n.;.R.e.b.o.o.t. .s.y.s.t.e.m.,. .p.l.e.a.s.e.......

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201728
Entropy (8bit):	6.3607488106285075
Encrypted:	false
SSDEEP:	3072:rmqdVRkbN1G3OKtVLqKc3IuQquARCASmShKJ:rmyTmNw3zqKcFLRs
MD5:	1D4F8CFC7BBF374CCC3AAE6045B2133D
SHA1:	802EDF0B0ED1D0305BCD6688EE3301366FEC1337
SHA-256:	C04885562F17BAEEFBCD2D4FC29F054EB8A66C44BD015750498C69A912D94C1F
SHA-512:	68643A30FEA87B2B61AF546F42BF32A25459152C1BCCE5A8A881714139CE828DFE4237874FF1E9CC3B78D6CDBEF7DD45C9F3459C3337D83693C704C274AFFF3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gBYz86HSwI.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|..[.................\...........v............@.................................................................. ...................@...................@...G..................................................$................................text....S.......T.................. ..`.itext..D....p.......X.............. ..`.data...<............`..............@....bss....<Y...............................idata...............z..............@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc...G...@...H..................@..B.rsrc....@.......@..................@..@....................................@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	61034
Entropy (8bit):	4.429529654892776
Encrypted:	false
SSDEEP:	768:nebbtdP4XFsh6HWiIZTYp7JtMLG54ttg2kGPyWtvQTznCKDMlV2f:ne3KOhTTocL8HnMlV2f
MD5:	7303B5AE0B8911CEB238DC01419695BE
SHA1:	22B89BDB8FAEC62BA3E66639E38E6271B593944A
SHA-256:	88155FB3F0E198AA4A24F9CFECBB83C5A4E081C6EA362BC50294410CB2FB5C50
SHA-512:	8AE802616AF60BAF214E254F6A55D312DC46B6E3F8BEE5F50E30E372FF38103776278B5FB07A562C2149EEA58107CB427A03B1629F72044AB69D3507E5DFAB15
Malicious:	false
Preview:	[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.2.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .OUL.....e.r.r.o.r. .=. ./.......i.n.f.o.r.m.a.t.i.o.n. .=. ........n.o.t.i.f.i.c.a.t.i.o.n. .=. ....w....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .!q.l...S.g.RD}Ka.0\.n.;...e.[. .L.i.t.e.M.a.n.a.g.e.r. ..g.R?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0\.n.;....e.._j.\|q}.0....f.m._.s.e.t.t.i.n.g.s._.r.e.s.t.a.r.t._.s.e.r.v.i.c.e._.t.o._.a.p.p.l.y. .=. ....e_U.R .L.M. .:O.ghV.a(u.z._.NWY(u...f.0....f.m._.s.e.c.u.r.i.t.y._.f.o.r.c.e._.g.u.e.s.t. .=. .7_6R.O.(Wdk.\|q}.N-..[.....asTW.@b.g.}..O(u.....S.g.O.X[.S.kP..0 .!q.l.O(u.07_

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	58794
Entropy (8bit):	3.642324420313977
Encrypted:	false
SSDEEP:	768:D+XPobz4qFlRiiXc0HwgHSSxnrKT7nke7GShFBy/x97fuTLY57aC7I/Fj:yPQMw1ZOT7kef1y/X7fuTq4j
MD5:	606DC375E898D7221CCB7CEB8F7C686B
SHA1:	26DCF93876C89283623B8150C1B79EDB24B6A7EC
SHA-256:	F442E440580EA35040E35BF1D85A118E7C182FDE0B9BA2A3C1816DEAB5F822BB
SHA-512:	9FBC42165B51A2020D2DA2FFE33287A4F3AA33639126813B290D329D47C4F4DA8F297A47AF3C1F63AF6F9E1BA47ACE840BC1660D603E17589E5DB6DDA0E1E5B1
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.5.5.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .S.o.r.u.....e.r.r.o.r. .=. .H.a.t.a.....i.n.f.o.r.m.a.t.i.o.n. .=. .B.i.l.g.i.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .B.i.l.d.i.r.i.m.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .H.i.z.m.e.t. .y.a.p.1.l.a.n.d.1.r.m.a.s.1. .o.k.u.n.a.m.1.y.o.r...\.n.;.L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t.i.n.i. .y.e.n.i.d.e.n. .y...k.l.e.m.e.k. .m.i. .i.s.t.i.y.o.r.s.u.n.u.z.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r...\.n.;.S.i.s.t.e.m.i. .y.e.n.i.d.e.n. .b.a._.l.

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (305), with CRLF line terminators
Category:	dropped
Size (bytes):	87912
Entropy (8bit):	4.303374267443204
Encrypted:	false
SSDEEP:	768:VUlHxa/yEOYEJNHWjlUu1pZ26ER2nkUTbfk74Q:aNxWREb4lUu1P29R2JbfC4Q
MD5:	3FC082E8F516EAD9FC26AC01E737F9EF
SHA1:	3B67EBCE4400DDCF6B228E5668F3008561FB8F21
SHA-256:	3DC0CEAE11F445B57B17B7C35A90B5133E313CF6B61550AB418252C5B8089C99
SHA-512:	9A9D20AF2F8C27056F58AB5A9C687F5124CE5F6D563E396C9558331FB8BE48E88E148B1FDC548A5EBDEDB451E3D89F2F96856F3BBFD695691D5687599F376421
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d. .=. .1.0.5.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...8.B.0.=.=.O.....e.r.r.o.r. .=. ...>.<.8.;.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.V.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...>.2.V.4.>.<.;.5.=.=.O.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.<.>.6.;.8.2.>. .?.@.>.G.8.B.0.B.8. .:.>.=.D.V.3.C.@.0.F.V.N. .A.;.C.6.1.8...\.n.;...5.@.5.2.A.B.0.=.>.2.8.B.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6307408
Entropy (8bit):	6.5944937257467116
Encrypted:	false
SSDEEP:	98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
MD5:	63D0964168B927D00064AA684E79A300
SHA1:	B4B9B0E3D92E8A3CBE0A95221B5512DED14EFB64
SHA-256:	33D1A34FEC88CE59BEB756F5A274FF451CAF171A755AAE12B047E678929E8023
SHA-512:	894D8A25E9DB3165E0DAAE521F36BBD6F9575D4F46A2597D13DEC8612705634EFEA636A3C4165BA1F7CA3CDC4DC7D4542D0EA9987DE10D2BC5A6ED9D6E05AECB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................C..F........C.......C...@.......................... i.......`..........@................... N.......M..A...@T...............`.P"...PN.<............................@N.......................M.......N......................text.....C.......C................. ..`.itext...0....C..2....C............. ..`.data... 3....C..4....C.............@....bss........0E..........................idata...A....M..B....E.............@....didata.......N......LE.............@....edata....... N......ZE.............@..@.tls....X....0N..........................rdata..]....@N......\E.............@..@.reloc..<....PN......^E.............@..B.rsrc........@T......DK.............@..@............. i.......`.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7753808
Entropy (8bit):	6.615075046955521
Encrypted:	false
SSDEEP:	98304:D4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCAFIqOx9N:DXQ7SIEXeMBk2V4N/Nq2Iqw9N
MD5:	F3D74B072B9697CF64B0B8445FDC8128
SHA1:	8408DA5AF9F257D12A8B8C93914614E9E725F54C
SHA-256:	70186F0710D1402371CE2E6194B03D8A153443CEA5DDB9FC57E7433CCE96AE02
SHA-512:	004054EF8CDB9E2FEFC3B7783574BFF57D6D5BF9A4624AD88CB7ECCAE29D4DFD2240A0DC60A14480E6722657132082332A3EC3A7C49D37437644A31E59F551AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w#.f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g.. ............v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.... ....g.. ....^.............@..@............. ........v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	999944
Entropy (8bit):	6.626732213066839
Encrypted:	false
SSDEEP:	12288:SA9+TVJdg0YMgqAahyv0jKdTq4lrBhqSq/rt8VwGFrt:SRho0lgqA6yvnrBhq/rQDt
MD5:	ED32E23322D816C3FE2FC3D05972689E
SHA1:	5EEA702C9F2AC0A1AADAE25B09E7983DA8C82344
SHA-256:	7F33398B98E225F56CD287060BEFF6773ABB92404AFC21436B0A20124919FE05
SHA-512:	E505265DD9D88B3199EB0D4B7D8B81B2F4577FABD4271B3C286366F3C1A58479B4DC40CCB8F0045C7CD08FD8BF198029345EEF9D2D2407306B73E5957AD59EDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...`.-\.................J...........X.......`....@.................................................................. ...................@...........0.......@.. O...................................................................................text...0?.......@.................. ..`.itext..8....P.......D.............. ..`.data....:...`...<...N..............@....bss.....]...............................idata..............................@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc.. O...@...P..................@..B.rsrc....@.......@..................@..@.....................0..............@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	94772
Entropy (8bit):	4.284840986247552
Encrypted:	false
SSDEEP:	768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
MD5:	0E204FABE68B4B65ED5E0834651FB732
SHA1:	B338A6E54AA18F3F8A573580520F16C74A51F3D2
SHA-256:	302373D81F0AE15589206420CB01A266804C9FD1C1FF0D6E09CE6BA3FEF92B64
SHA-512:	AAD76F6A76DC693D959389CE471BC585D0DA72737FED99F42F219FDC7C71617C00E8003A467092E12820A359D672C6FB80D99772F3F6433923B2ABB7EEA40F08
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.4.9.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...>.?.@.>.A.....e.r.r.o.r. .=. ...H.8.1.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.8.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...?.>.2.5.I.5.=.8.5.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.2.>.7.<.>.6.=.>. .?.@.>.G.8.B.0.B.L. .:.>.=.D.8.3.C.@.0.F.8.N. .A.;.C.6.1.K...\.n.;...5.@.5.C.A.B.0.=.>.2.8.B.L. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r...\.n.

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7752272
Entropy (8bit):	6.615186281886958
Encrypted:	false
SSDEEP:	98304:y4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOxJn:yXQ7SIEXeMBk2V4N/NqiIqwJn
MD5:	84FB34E529BEDE393A3F604EAA8137B2
SHA1:	195EA03B7BD086454A13C0D8357E0A9E447D9EC9
SHA-256:	1E396C4066AC8F421A54893442A0D76C4F8D4146E63825D67DFC0DA782E73EE5
SHA-512:	A48A80D62E588667B4C891CDED279BABFFA5FB4FDF092F345212F81D29A9ACAA06E6DB27B49DC601909409A3C82AA9272BCDF90D0AE1738E83E80D9FCA4D93E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g..............(v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.........g.......^.............@..@............. .......(v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11361360
Entropy (8bit):	6.496049600782297
Encrypted:	false
SSDEEP:	98304:AshiRp5hPI7N9sSA5wbZXJOu/0uOXZYfmQYanSjS+cWuNOlQpgfYLyPsd+QgBBP5:Al5hPwgvyAjDjS+igfgym+bHJxmK
MD5:	B0E355EC3453C8FFAEE08CD4257E96F2
SHA1:	0FA023CA8F1C1ECDADDE3DD3BD551870C2D965E2
SHA-256:	60248BA026064B116E4F94020DABB74DF519F5B4C41379CA19A38D725692CA8E
SHA-512:	B6004F83FD78EED84BF21611EFA45F2FFADF3625E0A2FDCDAE531B4734A4B886EBFE5EBE990DA42302B7368282D83DFFEF19E71DA8EC4C155EE5C8619AD028DD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................v..67.......v...... v...@..........................0...................@...................p...........L...p....+..........:..P"...................................................................`.......................text.....u.......u................. ..`.itext...6....u..8....u............. ..`.data....R... v..T....v.............@....bss.........w..........................idata...L.......N...Xw.............@....didata......`........w.............@....edata.......p........w.............@..@.tls....`................................rdata..].............w.............@..@.reloc................w.............@..B.rsrc.....+..p....+.................@..@.............0.......:..............@..@................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107848872158971
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrn:KooCEYhgYEL0In
MD5:	0E1CB12D1B5028D32C64A528C76059C9
SHA1:	BD0C7B712F10E05A4CF4007A6DA9279E35D4F1A0
SHA-256:	900AA385255B17E11DE47AF48238415A52BF58883CE03E6594BF6A9C407B335D
SHA-512:	FD07B8C3C47C1154B90BD98D7F22F34CE8B0A84BD3CA10C7CD1EFAD2440F17E0F73DA4EE4141CF15466F5B2B14A2CF3043AF55F2B06CB9087B7FE7A4973B03E9
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1a33c34f, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221250569506558
Encrypted:	false
SSDEEP:	1536:/SB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:/azag03A2UrzJDO
MD5:	E3C0E42937424928E4460874E8B23A68
SHA1:	C5E7A0F1DC1D949DFDE854A2A425398BB5043E67
SHA-256:	BE6B63BFD9584928A977F9C6538FB45E3E85B4711ED606D9C0868758BFDAD27A
SHA-512:	197D9E45D2685100F548A4896E1BD606D9877CAF007B4364EB488FAF09CEE1F60304E1CEB821ABEA070177B251D5B9ACF7837CB2CDBF9A98CC98E2A42684F7B5
Malicious:	false
Preview:	.3.O... .......Y.......X\...;...{......................n.%......0...\|.......\|..h.#......0...\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................pr.0...\|...................*.4.0...\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07573553367450145
Encrypted:	false
SSDEEP:	3:UXSllWetYebSG9wgXlHa7gcvZWXlAVw7gXlAllOE/tlnl+/rTc:UEzbSs1HaEcBW1wwE1ApMP
MD5:	FA82F0124AF87BE96D4B35974C97549D
SHA1:	6800DEF28F1C96B03DD62E13B86C124C18B5E552
SHA-256:	9133DE3CAEF68900BA02EF55270C687385201295E41ACAE48F0265D2B30F68D5
SHA-512:	8C835D5C144E6FAD0E24FCAF3CD0E2CF25A7EDF522E1A1A0D4DFB6D87522F2DB6662EC55A78F4FA520257B0F821A958E4FCF2637726C8A27A7B902F91F39A1A0
Malicious:	false
Preview:	>........................................;...{.......\|...0...\|...........0...\|...0...\|...,.\.0...\|...................*.4.0...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 17:41:10 2024, mtime=Wed Oct 30 20:46:14 2024, atime=Thu Aug 22 17:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	3.923866114021259
Encrypted:	false
SSDEEP:	48:8l2VsdOpzEHQUZd5Y+d5YsP5qoZkmrSUp8JWqoZkmtYz:8lazEHK9O5qoZbcJWqoZbt
MD5:	97F806B4F8D63B7E8EC7C73142B288C6
SHA1:	B5DBA5A1312D69E8D51E7496C51D9A4B572D631D
SHA-256:	5A74BA47EC72136B3C7A924CF47F7857AB1318F04098C8D33B81BDAF932347BB
SHA-512:	22D72C2C1484CD2AF05A312DD0914655F5D6B4D2822606A42977DE9FBBAEE56FE14F0BC1974BF98A4F34437C10B9069C7D0724954F5D6D5BC9B5FFA876F27B79
Malicious:	false
Preview:	L..................F.@.. .....>.....W.r$.+....>.....PPv..........................P.O. .:i.....+00.../C:\.....................1.....^Y...PROGRA~2.........O.I^Y.....................V.....$.!.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1.....^Y...LITEMA~1..b......^Y.^Y...........................9...L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%.^Y...............................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k............-.......C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.c.o.n.f.i.g.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	3.1573107695942624
Encrypted:	false
SSDEEP:	48:8ddOEPLqd5Y+d5YcCP5q2DT2S0Wq2DTKX7:85LJ9cM5qUoWqUE
MD5:	5FC67E19699B3F0B2AB7B4B89B0B3F1A
SHA1:	6F6380DF2EB8C5D30452A846864F001A8B0E473A
SHA-256:	45451F933B472FA53301D46B7C072AF67E51EC60172E6E9C01E0B308DF78A2F4
SHA-512:	81C7A9F5683DB54893BD26A6EC1BCBDB17983037668CD996E03934E7708331594195DBF2CCE9EB2B0C0567A9E8B24DD629D40866D49E55C9DF77A864D15744E5
Malicious:	false
Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)..."...1...........LiteManager Pro - Server..b............................................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r...(.h.2...........ROMServer.exe.L............................................R.O.M.S.e.r.v.e.r...e.x.e.......L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.a.r.t.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.R.O.M.S.e.r.v.e.r...e.x.e._.9.D.0.9.B.2.B.C.2.5.A.2.4.1.4.C.B.D.8.4.8.E.2.B.7.5.8.9.8.6.7.6...e.x.e.........%SystemRoot%\In

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 17:41:10 2024, mtime=Wed Oct 30 20:46:14 2024, atime=Thu Aug 22 17:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	3.9052367955304583
Encrypted:	false
SSDEEP:	48:8+2VsdOmJW5UZd5Y+d5Ys5qcxFWT84SslWqcxFWT8cYz:8+7JWd9s5qcxYT8SWqcxYT8c
MD5:	10805EC97F0086CA32DFD6E51FDAAC97
SHA1:	D79BEC0ADD0538F4CC2F951CAEF8A8DD62592716
SHA-256:	DA3C1043DB13DE4000EF19902E0F95ACD6B12AD1D8C100BCF9B70DDDE49FD011
SHA-512:	D301B00D1C17C8BC251F2E5C02DAF80BABB9338EA37AC7CFAF4EEC5901A92E0C8BE7CB84B09785EE66A601DFBA2A15C20C05D322076C5049BBF755EF439ACF68
Malicious:	false
Preview:	L..................F.@.. .....>......9i$.+....>.....PPv..........................P.O. .:i.....+00.../C:\.....................1.....^Y...PROGRA~2.........O.I^Y.....................V.....$.!.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1.....^Y...LITEMA~1..b......^Y.^Y...............................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%.^Y...............................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k............-.......C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.o.p.l.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.s.t

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Oct 4 09:56:56 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	3.8801422945484
Encrypted:	false
SSDEEP:	24:8WnJ+DAvws3ebTAyPwB+sHyjv/+MTyjvejIKZDUHwGS7ke4WTyjvejIKZDUHwwcs:8WnuAvob0dHOn5qmjlt6ScWqmjltZxD
MD5:	0C3FCEB1782B1F3601DFE7B293D0B55F
SHA1:	EA75913536F71C5D4A3115924DDBE78A5142B107
SHA-256:	1ACA4468818222046B4F70753EC84600E1D399B42337B438E85066B6D470D6E1
SHA-512:	C43C164006C8A3208B6EC494BE92EAD4E31247C0573864CC3B3BA6E2B1CCA2922A89FB820160FA425B01B7F153EB3B360EAD744157A81C9844D1B43175DC89B8
Malicious:	false
Preview:	L..................F.@.. ...25.....1>.~....25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH^Y.....3.......................9.W.i.n.d.o.w.s.....Z.1.....^Y....SysWOW64..B......O.I^Y.....Y.........................S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBIDW.V................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M............-.......C:\Windows\SysWOW64\msiexec.exe........\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.s.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.U.N.I.N.S.T._.U.n.i.n.s.t.a.l.l._.L._.7.8.A.A.5.B.6.6.6.2.5.1.4.D.9.4.A.8.4.7.D.6.C.6.0.3.A.F.0.8.9.5...e.x.e.........%SystemRoot%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C6

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20993132547282
Encrypted:	false
SSDEEP:	6:6xVpr+q2Pwkn2nKuAl9OmbnIFUt8vxVFZmw+vxVpVkwOwkn2nKuAl9OmbjLJ:6xevYfHAahFUt8vxH/+vxV5JfHAaSJ
MD5:	0C720A8681A606420C6D70E6170B42B6
SHA1:	B0EE1A2A4DDF40EDE957A816E8DC23324B92D914
SHA-256:	C4ABAF2533ABD4506DF028445639316172EC074B9654CF8C79532043B6AF440F
SHA-512:	6873F939FA7AE64697848F77CA8AAD3F12A01BA3387407FFCDAAFD82A8DCA15A5F4A84743AD3524EF6E9BD272336D999F290C16951A886E6AB122565DB6A89DA
Malicious:	false
Preview:	2024/10/30-17:46:08.685 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/30-17:46:08.704 1ea8 Recovering log #3.2024/10/30-17:46:08.704 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20993132547282
Encrypted:	false
SSDEEP:	6:6xVpr+q2Pwkn2nKuAl9OmbnIFUt8vxVFZmw+vxVpVkwOwkn2nKuAl9OmbjLJ:6xevYfHAahFUt8vxH/+vxV5JfHAaSJ
MD5:	0C720A8681A606420C6D70E6170B42B6
SHA1:	B0EE1A2A4DDF40EDE957A816E8DC23324B92D914
SHA-256:	C4ABAF2533ABD4506DF028445639316172EC074B9654CF8C79532043B6AF440F
SHA-512:	6873F939FA7AE64697848F77CA8AAD3F12A01BA3387407FFCDAAFD82A8DCA15A5F4A84743AD3524EF6E9BD272336D999F290C16951A886E6AB122565DB6A89DA
Malicious:	false
Preview:	2024/10/30-17:46:08.685 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/30-17:46:08.704 1ea8 Recovering log #3.2024/10/30-17:46:08.704 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1792027450512155
Encrypted:	false
SSDEEP:	6:6xVm3Vq2Pwkn2nKuAl9Ombzo2jMGIFUt8vxVouzgZmw+vxVWc0IkwOwkn2nKuAlx:6x43VvYfHAa8uFUt8vxfg/+vxczI5Jfg
MD5:	707F53CF73E11859EA01A73435EC8387
SHA1:	35189FBD19754EAAD993BE79655060D2C7EC7D21
SHA-256:	F8DFEF41315E7E6FE89C479EF57DA7D958A9F3841843A14C132A6E212CF79E66
SHA-512:	5E6C72A70C3934BBB7FF71D177DE23B6AD8B9453E3D173D2273C4EFF05A6FFCAAB350241F4FD93BF45668BB247F3C332849AE04BD3B98189516100430FC2554C
Malicious:	false
Preview:	2024/10/30-17:46:08.802 1fe4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/30-17:46:08.803 1fe4 Recovering log #3.2024/10/30-17:46:08.804 1fe4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1792027450512155
Encrypted:	false
SSDEEP:	6:6xVm3Vq2Pwkn2nKuAl9Ombzo2jMGIFUt8vxVouzgZmw+vxVWc0IkwOwkn2nKuAlx:6x43VvYfHAa8uFUt8vxfg/+vxczI5Jfg
MD5:	707F53CF73E11859EA01A73435EC8387
SHA1:	35189FBD19754EAAD993BE79655060D2C7EC7D21
SHA-256:	F8DFEF41315E7E6FE89C479EF57DA7D958A9F3841843A14C132A6E212CF79E66
SHA-512:	5E6C72A70C3934BBB7FF71D177DE23B6AD8B9453E3D173D2273C4EFF05A6FFCAAB350241F4FD93BF45668BB247F3C332849AE04BD3B98189516100430FC2554C
Malicious:	false
Preview:	2024/10/30-17:46:08.802 1fe4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/30-17:46:08.803 1fe4 Recovering log #3.2024/10/30-17:46:08.804 1fe4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8012a098-7e4f-4008-b5d8-2a7ee2b4d12d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9537402263162695
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlhsBdOg2H/Zcaq3QYiubInP7E4T3y:Y2sRdsNdMH/g3QYhbG7nby
MD5:	694DB18A09E6DDCC8279BC6D3BCC230A
SHA1:	7D1B9D584FE1EB22F272D8996BA09AD0CA06A4ED
SHA-256:	83A8F757725570F570BC8CEADA4249432DFBB043D514A6D8A6C6BBE9C99C2C47
SHA-512:	DFB9B587B5D0BEC0863D3ED35EE72FE1A4D67829F29DC402B391CA38D5BEB29FB894BDA18425401997B2584CF3D74CEC22990F9A8D863E1F2BE43FB470033889
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374884774551714","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":257713},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9537402263162695
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlhsBdOg2H/Zcaq3QYiubInP7E4T3y:Y2sRdsNdMH/g3QYhbG7nby
MD5:	694DB18A09E6DDCC8279BC6D3BCC230A
SHA1:	7D1B9D584FE1EB22F272D8996BA09AD0CA06A4ED
SHA-256:	83A8F757725570F570BC8CEADA4249432DFBB043D514A6D8A6C6BBE9C99C2C47
SHA-512:	DFB9B587B5D0BEC0863D3ED35EE72FE1A4D67829F29DC402B391CA38D5BEB29FB894BDA18425401997B2584CF3D74CEC22990F9A8D863E1F2BE43FB470033889
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374884774551714","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":257713},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258648322369581
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7gXlr:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
MD5:	03EECA2BD954DE67FF232D2126C2478B
SHA1:	59B860B5CB5D79FC0038523FCC7B26EDD926FA6E
SHA-256:	181B826A7EF7E16D231BA9ADCE7F30A373AFAF6C488AF3F339C147AD0CF4D765
SHA-512:	BE05D3E2AEF41C165864075864B1B4B0629F4596B8F802760942A0ABFE16FA464A9A2C54C79A510E9DD0C1D89B5B98D085E57DE154254F67D47B75AF9D7483DA
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.207728006136993
Encrypted:	false
SSDEEP:	6:6xVVlSVq2Pwkn2nKuAl9OmbzNMxIFUt8vxVAgZmw+vxVAIkwOwkn2nKuAl9OmbzE:6xcVvYfHAa8jFUt8vx6g/+vx6I5JfHAo
MD5:	B763976C0783AB2C043CDA4FBCEEA2B7
SHA1:	2A0BCB23CA448BC042D837442EF064AAB7BEB103
SHA-256:	359959CBACF5F15631D442A8C2F2B5C7E4267B4A009CD8B9E32832C1D5A16621
SHA-512:	106E2A6BBC39F8A4FF52625419D6525B6D57E10DF6B90B05F247D9E11FA05A7CD1949A39AA46A00F18E6C4E2F331ED8833AE3F6D6A6265ADC1C42DF1212C53D8
Malicious:	false
Preview:	2024/10/30-17:46:08.839 1fe4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/30-17:46:08.842 1fe4 Recovering log #3.2024/10/30-17:46:08.842 1fe4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.207728006136993
Encrypted:	false
SSDEEP:	6:6xVVlSVq2Pwkn2nKuAl9OmbzNMxIFUt8vxVAgZmw+vxVAIkwOwkn2nKuAl9OmbzE:6xcVvYfHAa8jFUt8vx6g/+vx6I5JfHAo
MD5:	B763976C0783AB2C043CDA4FBCEEA2B7
SHA1:	2A0BCB23CA448BC042D837442EF064AAB7BEB103
SHA-256:	359959CBACF5F15631D442A8C2F2B5C7E4267B4A009CD8B9E32832C1D5A16621
SHA-512:	106E2A6BBC39F8A4FF52625419D6525B6D57E10DF6B90B05F247D9E11FA05A7CD1949A39AA46A00F18E6C4E2F331ED8833AE3F6D6A6265ADC1C42DF1212C53D8
Malicious:	false
Preview:	2024/10/30-17:46:08.839 1fe4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/30-17:46:08.842 1fe4 Recovering log #3.2024/10/30-17:46:08.842 1fe4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444927360052521
Encrypted:	false
SSDEEP:	384:yezci5toiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rPs3OazzU89UTTgUL
MD5:	254BC797C7784FBFE360747CDA8C63B8
SHA1:	35FB1185ABE55DA86C4CFDF35508C01ABCCEF88D
SHA-256:	4AA14F748CA472C553B8B762D492581BA42543582642D23EFB6D9DCB7DDA469B
SHA-512:	AC21B706E00530DF9137B618B0C64C035C2BEB3D131DB47A4BA5A29ACECC13C901F1CB23F7C217C9ADE5EF4FCFA81276BBC2EC1A3F9309DF44FA6158DB8A3328
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7721743218905592
Encrypted:	false
SSDEEP:	48:7Mnp/E2ioyVfJKioy9oWoy1Cwoy1MJ5KOioy1noy1AYoy1Wioy1hioybioyeJzoA:7wpju4F/XKQ7Mb9IVXEBodRBku
MD5:	3A6EC371C35CA86EC49A4ADC3210A661
SHA1:	5CBD3B9C79B16A16E44EC919AA07602EFA7F8AE4
SHA-256:	06614F179E828F3E2F1049A198224EAB8FA1D07331197CACADFCAEA88BE5CD24
SHA-512:	B5A76D69665E1E21A23E5778B92E05338DCBFB77703AE82F43A60EBD17E5016EEBB75A42B33BAC4378841DBA9BF89D3D8163B5145C93EAEC3280B29E00138366
Malicious:	false
Preview:	.... .c.....H.q5...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFklS6VPNvfllXlE/HT8kX/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKLkPmT8QJ7NMa8RdWBwRd
MD5:	FBBB24AB20020124935DE70FA870BC2A
SHA1:	2EFA15AE0CE71C2B2972CD8124265FCA4AAE2A0B
SHA-256:	1D3EA86D687587D0AD04F3DE0F7B03C6D134F5EEBCAFE65E1939B1EAC9A5FECB
SHA-512:	D2FD67FA159D8C83F44406DAD86C78CE777160D0E8E906729129E5FD11F0B8F03486E6E8DCF9E465370F4846E7B9B3B1D5E5C5A05E4B935E11FAA00FB0862290
Malicious:	false
Preview:	p...... ........._.(.+..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kK78AF9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:D8ZDnLNkPlE99SNxAhUe/3
MD5:	E04C1B9706363A415F53771431A2EA4B
SHA1:	8665A02248D7573BA20CE7140ED3B694EF5DCCDC
SHA-256:	0F6822538046C0ED26C22699CEEFA8E970FD273F56BFF3D427487D9378017DE2
SHA-512:	9A4ED327EC11209721B7919EE9CB789BB63A6AC78C56F8CAFE544D574A80E5D0F528655439D92335805234F9E306B2A93CFF6A8B53D3C0E7FA2F4E3594AE1174
Malicious:	false
Preview:	p...... ........g.).+..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7664

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333920741364324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJM3g98kUwPeUkwRe9:YvXKXAkhcZEZc0vQGMbLUkee9
MD5:	876D78741B40B658A1E64D60EFA79F85
SHA1:	C635E88C3B1BA74F59EA314D226EA00957094267
SHA-256:	D443EB3EF7C29B4EE1D83A12D30368BD107C0C54A409868D17A64824C907A1E5
SHA-512:	EE9B292B36D689D84F715373511928CC8E924D2CA35813508F4C74D8243DDEFEA79C9DEEF1F7E79980B3FCA52612E2AC4029036C33A0CB8D4A65560D20EE0ABE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280789064471989
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfBoTfXpnrPeUkwRe9:YvXKXAkhcZEZc0vQGWTfXcUkee9
MD5:	465DF141B12059EB3D87CE01636BC9B0
SHA1:	2328C98550EA4163EE8A6C36FE6D24D50616EC4B
SHA-256:	88263B9C34C2A20B56C58BC755176DFE3E99CFE61C708E7FF10C5D39FF69BBF2
SHA-512:	59FE0791E5525953F628AEFE07F45D19A73572E4E9A362E2CCFF0A0F85D80CDF17EF3E1BC38B9E05786BB0D2BC9C94A91EEE8C6DA2D1D2993A75A3005F5335A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260315247546021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXAkhcZEZc0vQGR22cUkee9
MD5:	344539AF18517F246D6E82E94879E7CF
SHA1:	6846B1F2B67D86F9EB8DD90794BBABB193069641
SHA-256:	12DF5FD37CC4D4D02CF3D70CF5B25560572A949C4F7C42A0DB6A578F55B09C9F
SHA-512:	FFBB428D4E38165252741CD62BB78B09DF74EC57EFEA121E63BA95EA211904EFB302D5708584A6D46113400D4890D41181A2D8CA91714BC15BED91E192EADA23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319898172297978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfPmwrPeUkwRe9:YvXKXAkhcZEZc0vQGH56Ukee9
MD5:	8C95973BBF78DAD1EC967AF693ACF004
SHA1:	2197F8F47B829658A8F8DEAA69C67B6FD428696A
SHA-256:	43CE8D7B5310E6F3B26794A4301E13DAA4565DA2C776C5AC54ACF5C9616597C7
SHA-512:	35488B644A6D37A6CC464C2EB80D5BCDA2FC651F88DA7EEA7CCCECBC6542BC032A009250BC227950C0512F14817324FEC7F6B8E513735F190A32D220D219E306
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	5.654384638588982
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zvNpLgEscLf7nnl0RCmK8czOCCSE:YvEVhgGzaAh8cv/E
MD5:	5DA167567FC465EDD507BC11A9FC810C
SHA1:	D56037E5D5A42A4C062DD7051773D773852AE9A4
SHA-256:	5A62CD77DF23E4578D0B22C14F99F1928EBE983197DF7194ACE16DAD35CFB3C2
SHA-512:	A0304DDF1C0A59BC5C02103F9636F8CADA718A6FAB87E8F66DD06AA8A4E03D3734E9A38F5B8D478A41BB05E97B3F54F91CA22EBA88A217A1E97D08FC8496FBC2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.644556245962282
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zvRVLgEF0c7sbnl0RCmK8czOCYHflEpwiV1:YvE5Fg6sGAh8cvYHWpwE
MD5:	9A91A3091609B3DA5B7AB48BB3ED5E60
SHA1:	C01C9796ED73C93D9EDEFE3434FA00AA4883C52B
SHA-256:	C8AA217D767CD98B9BAB45BDC829121D2571485FA4B0E9F36140461F99769CFD
SHA-512:	78DC5E5851FD98FD549B86D9932F402D1C560E5EAD78944D96787B2944F17CBFC483E50765384FC95941E70B88690162B2A6FDE6BF3BAC78322B1E4F2CBB99CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2675984582679405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfQ1rPeUkwRe9:YvXKXAkhcZEZc0vQGY16Ukee9
MD5:	7F6086AD1C7FD13FC092EC331FCA3143
SHA1:	0760727D462D89F26FF3EAECC8CEFFA5B787198A
SHA-256:	288D41A7A59FCB9B18E171967780F14933DFFA8D1E7B16949C5200382FE26F18
SHA-512:	1BDA56374DBF3C5D223800627630121A67E1C33A7AF45ED996C7B2011BEDDFA510B3FA8714BB7DF5AD942E2FF8E35B6E5526F81E8DBB90BE20B686503DFE7B48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.636037490209418
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zvA2LgEF7cciAXs0nl0RCmK8czOCAPtciB1:YvEoogc8hAh8cvAH
MD5:	139857709FC79ABBAE21D6943203A802
SHA1:	C22CB98238D2FEFA5128906AFAADB1EDB2627C42
SHA-256:	3E32B86E2F43A3460F734CFC440B89C04B38C2A04A30311EF49BD4E7EC8217FA
SHA-512:	35AAEE45F12630FABF4FB003DA8934ABE6B596304E6AC2DA79FCA2FDE69B3B6D73BA19CCD8D6B6AF4C1AA8898AD3346AE491BD9ABE73365420FD38BB3FB32F0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.691696349964183
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zvIKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK51:YvEgEgqprtrS5OZjSlwTmAfSKD
MD5:	D44AB3D7632EFD3220CBB6EBAD5D40E9
SHA1:	81A091EC6F2E7AC4522A6D4F2D865F30F4F127A1
SHA-256:	39AB0F24D59DDDF554C6E9B80392A25A1873356F4E589C1B2F5ADE105EF0F428
SHA-512:	1553CA6D8A6A8DAD6020B420557E7BF1D23A3F81C05A557C83298A3583CD5C7B2677825EE27BFF86608FAA2D55FFB89CF8DFF20B2387802BE985C1E5285F47A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268277471360464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfYdPeUkwRe9:YvXKXAkhcZEZc0vQGg8Ukee9
MD5:	348958EDC7973BE1EE3FC2240B381132
SHA1:	81A95A37F205E795EE26A143DB1F37D3F7FFD03A
SHA-256:	2D6D76790DFF044A94DE3263545E0FBBBD31C32EB90C29E57F1FFC95A0D5A445
SHA-512:	063C50158DDFBD7B944C234F2A5DF05F3A6441D153783344479918C4FC72843CD8ED2D9B68B479F195018B6A9CF20C674F21D77B3423710E0EB69BFD86CCC148
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.772042343361548
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zvnrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN9:YvEvHgDv3W2aYQfgB5OUupHrQ9FJD
MD5:	5FCB5F6C723115EF17F7ABEBB82E2225
SHA1:	DFFB45C6B5A588F83CC507BB9F74645EF734CC8A
SHA-256:	2948DF1336FEFDCB06076149B5B7879E147BE40C2E759D2492FB8123B7F27445
SHA-512:	E0C1ACA18933199421101F7FE901A24906F700FFC1B08BCDB15DF2CE5AC33844859F5DD3383663522F437840DA8434A75BC2BED9435AF913389824643EEA5D62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.252042593286146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfbPtdPeUkwRe9:YvXKXAkhcZEZc0vQGDV8Ukee9
MD5:	D40AE26AF2178DAF2F4A0EC221311774
SHA1:	188BC4E41D4CDA3F7A161550D71A882AC8C24F1A
SHA-256:	9CB87F9539684588885046CFF5EB4139875033C57BD492308896D6315FF4F8F6
SHA-512:	42C9C896A14AF80AC068E35DF884DA50B812B8CD3B790DF0DA7D7789351D63003D00681E62BE99D7EFC3A8BAD2CD513F41AFEA64EED64DBE309E55AB45150B8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.257094926840532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJf21rPeUkwRe9:YvXKXAkhcZEZc0vQG+16Ukee9
MD5:	43C3F01CCF9B25BB682225A41103655C
SHA1:	45756C7D92D9873C786C1C14CE2366FF5B736CFD
SHA-256:	A5CA5699FE6EA19EB90C270B59144CC45212C577E787C0D1C8A80B52AE284414
SHA-512:	A6DBB0A6277FA1851A893A6E123405E37E1D1D22F798BF999BBFD780C4CAC529F30A48A36D9D8F580B3EE19EA027149D60152AC90B056D465C0EC726A1708624
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	5.625024976076591
Encrypted:	false
SSDEEP:	24:Yv6XAqc6zv1amXayLgE7cMCBNaqnl0RCmK8czOC/BSE:YvEhBgACBOAh8cvME
MD5:	D9EF4BCC4AC57A28880611EFD133391C
SHA1:	48F8F78741F58F6B4095A16EF20E33F973A17DF1
SHA-256:	8740C9598527EC266F5D4362F658C52D5A9046AE69C917E15C70392104E2CF8E
SHA-512:	C0352B927A8EF2CA44C53883C61BC83FDD2DD83F5CD45F115F12B0F1ABAF1280FE6A7AFD97556A640E4BD99D8AFE892EAB695B71F49F871743EEABF7B0AA8AED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.232330618810849
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD4ViXhclEc9VoZcg1vRcR0Yh2xoAvJfshHHrPeUkwRe9:YvXKXAkhcZEZc0vQGUUUkee9
MD5:	028BF6935DBD02450287F35E8F477E2D
SHA1:	35124BF6AE9DEC4785C162B2C188D910E2B1F4F5
SHA-256:	74EDB50921C284194AA2169A45A4B9ECE555DB4E55380A809F88721A5A8040D0
SHA-512:	D75FE9DF0069E68B616ADF5B2A2CFC6BD1001E611C7FD85A3F54D86C27024A3EFA86B356A66B6579DFBC87D39A987DFF7F0AA9542127BD6623B35C8DC9A6E193
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.357232349707505
Encrypted:	false
SSDEEP:	12:YvXKXAkhcZEZc0vQGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWx:Yv6XAqc6zvG168CgEXX5kcIfANhE
MD5:	B9AF8E7358CEF762D39943C73F446D63
SHA1:	EE446FA654894306DE2C250876C08D5D50D2FA83
SHA-256:	11D41F95AC517BAC0A8BCA72A821B8FBA26E459D5565B0B745EE18CAA97FA52D
SHA-512:	627F8E72D749B961858FCA68F69B841FCD28E089097652E32250DF1E368F98E3ECC867FD3F3A3C9AF8CAF2B2DBCE0383595751143B4EDF463FE86E0FF56247F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"440517ac-0e07-48e3-a4a5-4b9ee08adfad","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1730498130612,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1730324775652}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.143808960267192
Encrypted:	false
SSDEEP:	48:YvFvplNk7aCF06d8mD4ZAQmL3dgMuj9lA:uvjNkb06amD4ZRm5gM8lA
MD5:	898FC4EEFA45AB6AC08869D6737741F6
SHA1:	C392940AC0D8FC76A25ADBB44F459C17F12929B3
SHA-256:	3E3D0FDD4B656E8C20909ABE3CEC64021F9F835E3553C9C9AA551116465F756B
SHA-512:	8521C8817D192FFFB2F2645FEFE90C60CA0051E91B504BC35C9F37E028E30AC5BD6ABAEF48AD89B91EBC17CE00841F32878435185FCD07521F0533190890A145
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2b3a3b264036d1bf8ab6f421041cb435","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1730324775000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3d3abf63ca4cdb57e29fc1fde7d2bf20","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1730324775000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"43847b7fcc8fd661590cb2fcf92e62bc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1730324775000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f61883c56fdf21de335f1b1e7b49231e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1730324775000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"cbc6604f3a3276f47f3aee62a722ecf3","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1730324775000},{"id":"Edit_InApp_Aug2020","info":{"dg":"91736647a48f747403f2a91e7a51ee09","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1881595810725065
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU0oSvR9H9vxFGiDIAEkGVvpYG:lNVmswUUUUUUUUR+FGSItV
MD5:	7C83CE2D5F9C355F3373A0ABFF7272FD
SHA1:	4EC952AE27B03FC68A995C359FC47E75DD44C4F3
SHA-256:	2E30610F1E175E4244C3D0A65AF915D34BE3F1720CC69AC95CBD9315CEA87441
SHA-512:	F5932D4FF6EEF1621EB6D926C019E13153183049A6B54E1F9C845A7380D5164F53144BB820F126195B1ADCCEF64CC7E278CE6687A35581323A60E99C5B1D437A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6079818744904641
Encrypted:	false
SSDEEP:	48:7MQ4KUUUUUUUUUU0qvR9H9vxFGiDIAEkGVvRqFl2GL7msr:7/UUUUUUUUUU9FGSItTKVmsr
MD5:	D04D482FFAA521DB5BE4256685AB2F84
SHA1:	92775EF6E34E5254CF2C6E7245D1892F49D25F6B
SHA-256:	6FB94F4487C0C487C53091FB0BE0180E95C5E7BEB4E2E0C1E274F5D0A8993255
SHA-512:	8BCF60246215A086458D8882335B5905F21C6B066ABF8E2CBB5E332960628ED31DBACDAEBDC272B8651478CF4685BDB840FCAAF0F25C0A18BDFA13E97C82DCB6
Malicious:	false
Preview:	.... .c.....).......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Doc.pdf

Download File

Process:	C:\Users\user\Desktop\0438.pdf.exe
File Type:	PDF document, version 1.7, 1 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	125552
Entropy (8bit):	7.579988719622451
Encrypted:	false
SSDEEP:	1536:N0N5xSlECZcbZ42IlWpy67H/AvLpMpBXCF4KMvX6UkMZdEMLHMgifPdEoLIeLA+6:CNPSiJZ4xy8DlivXREMBOlEoMeLjCiQ
MD5:	7827620BA2CD12D54B41C006BA4D686C
SHA1:	F6B40CB23006AD0E1AFD4C08CA943A75258FAB34
SHA-256:	9DAA46F8D84B0E65E2D5FDF7FCD80FF6CA922278C32A2B5C9425C0C5EF7D2096
SHA-512:	9782FB4DBA6F62A589BF213AE5CCE3F66514319363F499B584DC854ACC1DCD94221102BDDAC982AA9DB36C5B7696BD1ABACF7C15771CDECC317B2F3421CCA321
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 11 0 R/MarkInfo<</Marked true>>/Metadata 22 0 R/ViewerPreferences 23 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image9 9 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 188>>..stream..x.E.K..@.......R..!.4 .\|$FB.."ZH.+............x.h..!/."..f....X.Q.8M.D0aGK..+.J{x.....(.kJ.FBJ&\|.7J...H..f..%..Nory..M'...m9%g.......4.(AV&............2...H..B...Z..o.V#.c.....6k..endstream..endobj..5 0 obj..<</Type/Font/Subtype/TrueType/Name/F1/BaseFont/BCDEEE+Calibri/Encoding/WinAnsiEncoding/FontDescriptor 6 0 R/FirstChar 32/LastChar 32/Widths 20 0 R>>..endobj..6 0 obj..<</Type/FontDescriptor/FontName/BCDEEE+Calibri/Flags 3

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-30 17-46-10-833.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.336971251821874
Encrypted:	false
SSDEEP:	384:pC2D2mHwdrMkp7HYywXiCBaI5XYoucwSUCdRz3Dv6edRLxsyQli4I5IpQnVucZhG:Am8
MD5:	4155B09F6331D883485E79A7246B1328
SHA1:	991AE24E3D9D509EA52CA7B3B6015400DFF50A69
SHA-256:	6D526096CBFF72BAC6D78C34FEA0B3605F56451F7A388FE37458CCE8576B7A2D
SHA-512:	CB6FDC86DA2180276A4469E3AB74EBB922C104B9BD3BC4F882D71F68E752B249F517970AAF7E75C520283420F3757374D026DEBF50F336A708B866A91CFA739B
Malicious:	false
Preview:	SessionID=8bde57c7-7043-40f5-a25b-31d1a8468f83.1730324770844 Timestamp=2024-10-30T17:46:10:844-0400 ThreadID=7352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8bde57c7-7043-40f5-a25b-31d1a8468f83.1730324770844 Timestamp=2024-10-30T17:46:10:845-0400 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8bde57c7-7043-40f5-a25b-31d1a8468f83.1730324770844 Timestamp=2024-10-30T17:46:10:845-0400 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8bde57c7-7043-40f5-a25b-31d1a8468f83.1730324770844 Timestamp=2024-10-30T17:46:10:845-0400 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8bde57c7-7043-40f5-a25b-31d1a8468f83.1730324770844 Timestamp=2024-10-30T17:46:10:845-0400 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3890325324560155
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rz:n
MD5:	3DABF7AC63CF081A2D079DEDE24405EF
SHA1:	998F8E2474E2FB8BB4614F90AF3712B38F9A71C1
SHA-256:	3DF950C4D09C8ED78FECF715BBACE5E7C5A381C58F252361E37170BC07119ED4
SHA-512:	A5C4A3AB4F1187BBDFF754B93F750BDB63920C9B03F0825CC80E1D4C0B37197E6A88CBDDD6EEE44CD201DC97CD4014275C22F9A7D5A808C003C4CD3EE243253C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\108229d1-2931-49b7-986c-c055cba311a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\1e945f66-0fe4-4ac4-b405-e3112b3c2e9a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6047f729-2554-49c7-b027-11d6aedf2d7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\73cb08e8-44be-4f78-bae0-658de012e55f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\pdf.msi

Download File

Process:	C:\Users\user\Desktop\0438.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\503870.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\503873.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI3D90.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	294216
Entropy (8bit):	4.850811114045699
Encrypted:	false
SSDEEP:	3072:nzoy2KjcC2jcmFDX/vjcJGUjcmFDX/rjcmFDX/dZ+oNbynfk:nzoy25DXmNDXLDXX+oNbynfk
MD5:	8BEF72B05B3C4F607A8A19D025085F14
SHA1:	AE8F48F200CF4E59955F7D305820875F92591359
SHA-256:	653352B59079E5ABDFDE72AA4F61AEED60463EB17E75E7C423A2A843749F2293
SHA-512:	FF1AC5FE6001EE3249CE8403B8844C94C71C6341BD746A7C1791FC442CF1CC00C21D5E879BCF430E1BA58540AD32C1593A69364834968C07C5CE7DA9B15D1EDF
Malicious:	false
Preview:	...@IXOS.@.....@.^Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..pdf.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{3244CDE6-6414-4399-B0D5-424562747210}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}5.C:\Program Files (x86)\LiteManager Pro - Server\Lang\.@.......@.....@.....@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}C.C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{596F4636-5D51-49

C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1622879140215452
Encrypted:	false
SSDEEP:	12:JSbX72FjSQAGiLIlHVRpqh/7777777777777777777777777vDHFGpZl0i8Q:JMQQI56dF
MD5:	8099B778F57842AE9C6800315D49EF73
SHA1:	1FB8A9F69F7B999FA824EFFA902332A4FB083C20
SHA-256:	3CBBD8E41A3C4B36A8737FD5CDE72220076867E7AAC086E245D72EBA714CAA6A
SHA-512:	8C11940965E9B3FBAE154EA89229C0D66B6FBEA51DDE066FEDA6189F307511AF665E6C96D85B5B0C47E5593A868094EAA451E832E484CCF22BDE4A3E2030B3C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.786966154456378
Encrypted:	false
SSDEEP:	48:N8Ph+uRc06WXJMnT5SlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:wh+1vnT0wurGm0WlfPu2qC0WlfIF/
MD5:	664BDAD03857943DF9992B2FCC2ED413
SHA1:	4BD3268B5820AB24FB63B5DA58C481EAB91E5043
SHA-256:	E3266CCF168D3FAB43854CDF55FAF9BC38CD9BF3C653F8598B28D73B14F17D8E
SHA-512:	FB02A7302BB74F9B5ADC603FA657F6C25081B2036E0AE42BA968EF78EC006392538FEA0647747FF23DC81F49F1129E0006397D399D436AEB3F804C3EE6391811
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.351781833522881
Encrypted:	false
SSDEEP:	384:AvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZUNeLNek+vDFNe+TNy:+MAyYdTmPJbgqcnDcCNy
MD5:	CA680899D9330BEB85E6351E6DC0D27B
SHA1:	41E89E582F58FB2A4ED06FA3BF796A1DAAC5CB6C
SHA-256:	EAB5DC45781E92CD5CF953016757B1E6F2ED7A0B5A97CC0945B19A8FBC1A85F2
SHA-512:	3817BD6EC345F96631E6CBF6C8DD384ACB17D912B1EC69D959F3AA15C05226D5FE3B5E9807D42D0E63589AABCEADFBE8BD5F293D8069DF689D12498E05842286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(........0...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.31126714354722
Encrypted:	false
SSDEEP:	384:EvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZMwQE3vGYksuektm6yysZc8:SMAyYdTmPJbgqcnDcmwQE/RkHRRNS
MD5:	6A4AFFF2CD33613166B37A0DAB99BD41
SHA1:	FBC0F1696213B459D099A5809D79CFC01253880F
SHA-256:	53C1AE4962663E82D3AAC7C4A6CBE3D53E05D6948ADAE6391A2748396ACF98FE
SHA-512:	7B61D32E4AD38BC21E86559BFFA49A334CCB6184E595CB43F2D60A2A77C86B31D07B1A9D1F8FBE69E9AAD7E096952D765404BEBC494E73BD992642EB6B82E3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...p...............P....@.........................................................................4T..(........+...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....+.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375173287975219
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaui:zTtbmkExhMJCIpErr
MD5:	93ECE654207406D3F2099086A88D7B3F
SHA1:	4659D94BB41C74D9A576EA9B0FAE877B4197D5A7
SHA-256:	76CCF6ADFC776D5AA5F25BC0E92855D857C864EFD738BB473ADAD1BDB8C445C1
SHA-512:	096BA43729D801798009EBC2F6237D0F0142BAD3987B22371A2B2C7A860BD3654A2C5A2A3E00971C2B8FB73F49E508A5D6AEE4CBDFD2733B446C3A6B7B17AE80
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\~DF045F6D29164BEA95.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.221724417966281
Encrypted:	false
SSDEEP:	48:PHwmFSB29lOd5YpRXd5YNd5YGd5YMd5Yu9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad9:PH5FqC0WlfVm0WlfPunCiY
MD5:	ACBA2F92AC3EE1BACD8AD4740D5E07F8
SHA1:	4D4CCD9A9B63367876C7EC16DA626204DFB0A21B
SHA-256:	67183AF23FC26266026BEC73128F0A6D11C6E1E326EC4F3B71F51A3822852268
SHA-512:	62715C497F2E7509A992023060311767EF57E50187E36E9FCAE8E5A81E1F3D522589D4DD0B876350D1CDA683072F913F88E99010837BFB759926F1B9018E505C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF28245C8D906300D2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4157586403444926
Encrypted:	false
SSDEEP:	48:5ZlWuDM+CFXJjT55qXlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:JWZ7T3cwurGm0WlfPu2qC0WlfIF/
MD5:	0F73EE27EFBA7E7549041C1E340C4BF4
SHA1:	63346080779568E8733A7635C64403C7F22B0CF3
SHA-256:	75C2F62679B02B31FD7F5702C31B8D99763AF6810AB6461DFB7818FC6C4BB8D4
SHA-512:	B02AD11B65DBA2685C9FECD622F104C2328A49614A36ADBCA4BE6AD14876C41DDF7550179B36BA7A2A7852320F0D467E4C707D8D2CB93E866F918B1669F62639
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3E9D1B8B739CE9D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06823846717123914
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOYYbmc6Vky6lZ:2F0i8n0itFzDHFTZ
MD5:	43121AF9C0468049B811D5DE9EE986C6
SHA1:	3D65F87A3C467D0DE2BF8F07A60621B947A9CE4C
SHA-256:	592C5B6D2ADD44B5EFCE1D5A353279925147188A1C15B56B1189E89FE97374E0
SHA-512:	0B09D5648F1374083996F24FF71AE87B22F152D907C91B84567CA27B985F05C447AF27527A3E760F44817300DB8680F73F5D86A36B9DC157AA3E6C5BB6BC6831
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F87AB64C16B0331.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.786966154456378
Encrypted:	false
SSDEEP:	48:N8Ph+uRc06WXJMnT5SlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:wh+1vnT0wurGm0WlfPu2qC0WlfIF/
MD5:	664BDAD03857943DF9992B2FCC2ED413
SHA1:	4BD3268B5820AB24FB63B5DA58C481EAB91E5043
SHA-256:	E3266CCF168D3FAB43854CDF55FAF9BC38CD9BF3C653F8598B28D73B14F17D8E
SHA-512:	FB02A7302BB74F9B5ADC603FA657F6C25081B2036E0AE42BA968EF78EC006392538FEA0647747FF23DC81F49F1129E0006397D399D436AEB3F804C3EE6391811
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF437719EDE9910C56.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF578AEE3EF53C1712.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4157586403444926
Encrypted:	false
SSDEEP:	48:5ZlWuDM+CFXJjT55qXlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:JWZ7T3cwurGm0WlfPu2qC0WlfIF/
MD5:	0F73EE27EFBA7E7549041C1E340C4BF4
SHA1:	63346080779568E8733A7635C64403C7F22B0CF3
SHA-256:	75C2F62679B02B31FD7F5702C31B8D99763AF6810AB6461DFB7818FC6C4BB8D4
SHA-512:	B02AD11B65DBA2685C9FECD622F104C2328A49614A36ADBCA4BE6AD14876C41DDF7550179B36BA7A2A7852320F0D467E4C707D8D2CB93E866F918B1669F62639
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76604B3D0163EF41.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF80F3692C37C55AFB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4157586403444926
Encrypted:	false
SSDEEP:	48:5ZlWuDM+CFXJjT55qXlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:JWZ7T3cwurGm0WlfPu2qC0WlfIF/
MD5:	0F73EE27EFBA7E7549041C1E340C4BF4
SHA1:	63346080779568E8733A7635C64403C7F22B0CF3
SHA-256:	75C2F62679B02B31FD7F5702C31B8D99763AF6810AB6461DFB7818FC6C4BB8D4
SHA-512:	B02AD11B65DBA2685C9FECD622F104C2328A49614A36ADBCA4BE6AD14876C41DDF7550179B36BA7A2A7852320F0D467E4C707D8D2CB93E866F918B1669F62639
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8A070A31F4CC314A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB6533660C7B796BA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCA82EF531E697040.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCEC3E934ED492C2D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.786966154456378
Encrypted:	false
SSDEEP:	48:N8Ph+uRc06WXJMnT5SlF9galrV9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISR:wh+1vnT0wurGm0WlfPu2qC0WlfIF/
MD5:	664BDAD03857943DF9992B2FCC2ED413
SHA1:	4BD3268B5820AB24FB63B5DA58C481EAB91E5043
SHA-256:	E3266CCF168D3FAB43854CDF55FAF9BC38CD9BF3C653F8598B28D73B14F17D8E
SHA-512:	FB02A7302BB74F9B5ADC603FA657F6C25081B2036E0AE42BA968EF78EC006392538FEA0647747FF23DC81F49F1129E0006397D399D436AEB3F804C3EE6391811
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9367051756500695
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0438.pdf.exe
File size:	11'654'747 bytes
MD5:	2d11dba46735af1cb1c0a42e9564e20d
SHA1:	b2e17960c6d080f7aba7df87f57c08b4bc2e7051
SHA256:	e19477a56b247e6cc435fee367abcf6e0c3db21de91ae2514b4a6b1807233c53
SHA512:	f053c18333c256c87492e7e74832f2ba695c1633cc80d59e4d426eda82d27d7402a22803e439bb2453f4fa12f00697de355edd61c300b7624c66723d7e54dad0
SSDEEP:	196608:tqwvI8YbsGBCEfbi57P6mCRTMFCxZ9zzvHLbax3QS+hbEPjwDhZzczDlUxMUd:ZIRwGjfbi5DCRoOPzzvfaEAPgOHm5d
TLSH:	42C6331BFF5D04EAF1AF99F899415022D7B57CC51720868F23B43E4AED736A1AA35302
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	3570b080889388e1

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA754C3A7E8h
dec eax
add esp, 28h
jmp 00007FA754C3A17Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FA754C39603h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FA754C3A313h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FA754C3C327h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA754C28B93h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA754C3B3E2h
int3
jmp 00007FA754C415C4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x5f334	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x5f334	0x5f400	ac83509a9abddcfebcee4527be350f1a	False	0.06483503526902887	data	2.1781366278912278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x70644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x7118c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x72738	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m			0.023615261709619195
RT_ICON	0xb4760	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.3191489361702128
RT_ICON	0xb4bc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.11867219917012448
RT_ICON	0xb7170	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.17284240150093808
RT_ICON	0xb8218	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.04436294806577547
RT_ICON	0xc8a40	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.08644307982994803
RT_DIALOG	0xccc68	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0xccef0	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0xcd02c	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0xcd118	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0xcd248	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0xcd580	0x252	data	English	United States	0.5757575757575758
RT_STRING	0xcd7d4	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0xcd9b8	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0xcdb84	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0xcdd3c	0x146	data	English	United States	0.5153374233128835
RT_STRING	0xcde84	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0xce2f0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0xce458	0x152	data	English	United States	0.5059171597633136
RT_STRING	0xce5ac	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0xce6b8	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0xce774	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0xce934	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0xceb84	0x5a	data			0.7555555555555555
RT_MANIFEST	0xcebe0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:46:24.811031103 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:24.811100960 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:24.811212063 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:24.811414957 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:24.811445951 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.577523947 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.578404903 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.578439951 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.581708908 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.581783056 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.670886993 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.671185970 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.671335936 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.719326019 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.738729954 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.738750935 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.785590887 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.802082062 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.802225113 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:46:25.802335978 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.855268002 CET	56266	443	192.168.2.4	96.7.168.138
Oct 30, 2024 22:46:25.855298042 CET	443	56266	96.7.168.138	192.168.2.4
Oct 30, 2024 22:47:21.522905111 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.529723883 CET	5651	56360	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.529833078 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.538011074 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.543967009 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.547394037 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.554315090 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.560133934 CET	80	56362	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.560381889 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.570128918 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.575911045 CET	465	56363	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.576010942 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.585314989 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.591212034 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:21.591356993 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.600874901 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.606724024 CET	5555	56365	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:21.606784105 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.660908937 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.660929918 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.666793108 CET	5651	56360	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.666801929 CET	5651	56360	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.676734924 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.676749945 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.682610035 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.682620049 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.692001104 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.692034960 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.697968006 CET	80	56362	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.697977066 CET	80	56362	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.707709074 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.707743883 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:21.713601112 CET	465	56363	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.713608980 CET	465	56363	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:21.723472118 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.723472118 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.729403973 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:21.729414940 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:21.739043951 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.739074945 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:21.744939089 CET	5555	56365	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:21.744946957 CET	5555	56365	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.255474091 CET	5651	56360	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.256042004 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.256145954 CET	56360	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.262011051 CET	5651	56360	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.291462898 CET	80	56362	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.291625023 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.291685104 CET	56362	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.297432899 CET	80	56362	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.433482885 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.435384035 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.435384035 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.435384989 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.435457945 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.435457945 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.441380024 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.441394091 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.441407919 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.441420078 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.441881895 CET	80	56364	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:22.441962957 CET	56364	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:22.635133982 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.635324955 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.635324955 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.635356903 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.635400057 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:22.641169071 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.641184092 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.641196966 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:22.641208887 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:23.107623100 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:23.160680056 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:24.123451948 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:24.176511049 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:25.140209913 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:25.191936970 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:26.154690981 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:26.207549095 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:27.170456886 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:27.223185062 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:28.186988115 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:28.238820076 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:29.201764107 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:29.254427910 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:30.066714048 CET	465	56363	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:30.067445993 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:30.069328070 CET	56363	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:30.075763941 CET	465	56363	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:30.100661039 CET	5555	56365	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:30.100776911 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:30.100835085 CET	56365	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:47:30.106699944 CET	5555	56365	65.21.245.7	192.168.2.4
Oct 30, 2024 22:47:30.217381001 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:30.270051956 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:31.232889891 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:31.285686016 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:32.233846903 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:32.285685062 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:33.249798059 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:33.301312923 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:34.367187023 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:34.410701990 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:35.280770063 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:35.332571030 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:36.296356916 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:36.348186016 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:37.311563969 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:37.363818884 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:38.327274084 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:38.379439116 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:39.327501059 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:39.379544020 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:40.343698978 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:40.395066977 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:41.359196901 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:41.410702944 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:42.374316931 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:42.426326990 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:43.375437975 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:43.426353931 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:44.391125917 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:44.441956997 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:45.406510115 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:45.457619905 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:46.612037897 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:46.660702944 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:47.423233032 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:47.473330021 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:48.438911915 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:48.488842964 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:49.454722881 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:49.504465103 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:50.470132113 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:50.520081043 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:51.471606970 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:51.535768986 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:52.486771107 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:52.535712957 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:53.501966000 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:53.551348925 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:54.517843962 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:54.566987038 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:55.533262014 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:55.582715034 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:56.548677921 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:56.598308086 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:57.564431906 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:57.613864899 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:58.580018997 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:58.629586935 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:47:59.580749035 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:47:59.629498959 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:00.597485065 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:00.645225048 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:01.611753941 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:01.660857916 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:02.627525091 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:02.676464081 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:03.643296957 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:03.691982985 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:04.658742905 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:04.707618952 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:05.674316883 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:05.723248959 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:06.675509930 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:06.723279953 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:07.691114902 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:07.738900900 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:08.706801891 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:08.754496098 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:09.722491980 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:09.770153999 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:11.738234997 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:11.738995075 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:11.739167929 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:11.739444017 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:11.739490032 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:11.754606009 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:11.755269051 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:12.786426067 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:12.832732916 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:13.789330006 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:13.832623959 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:14.801304102 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:14.848268986 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:15.815942049 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:15.863886118 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:16.818363905 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:16.863909006 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:17.833879948 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:17.879513025 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:18.849251986 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:18.895145893 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:19.865037918 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:19.910887003 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:20.880357027 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:20.926399946 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.523144007 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.529314041 CET	5651	56542	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.529520035 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.538356066 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.544337034 CET	80	56543	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.544413090 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.558281898 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.564785004 CET	465	56544	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.564867973 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.576545000 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.585150003 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.585349083 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.585432053 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.592178106 CET	5555	56546	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.592255116 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.660906076 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.660906076 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.667805910 CET	5651	56542	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.667848110 CET	5651	56542	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.676492929 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.676493883 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.683532953 CET	80	56543	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.683609009 CET	80	56543	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.692205906 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.692250013 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:21.698110104 CET	465	56544	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.698237896 CET	465	56544	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.707789898 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.707823038 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.714051008 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.714065075 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.723459005 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.723500013 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:21.729481936 CET	5555	56546	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.729556084 CET	5555	56546	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:21.895885944 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:21.942019939 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:22.250055075 CET	5651	56542	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:22.250814915 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:22.250891924 CET	56542	5651	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:22.254235029 CET	80	56543	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:22.254945993 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:22.255018950 CET	56543	80	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:22.256793022 CET	5651	56542	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:22.261893988 CET	80	56543	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:22.540862083 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.543493032 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.543493032 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.543493032 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.543577909 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.543579102 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.550214052 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.550228119 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.550240040 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.550257921 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.550836086 CET	80	56545	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:22.551346064 CET	56545	80	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:22.912795067 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:22.957647085 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:23.927767992 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:23.973290920 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:24.942941904 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:24.988912106 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:25.959009886 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:26.004614115 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:26.974390030 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:27.020178080 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:27.975414991 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:28.020194054 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:28.990835905 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:29.035806894 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:29.991527081 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:30.035797119 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:30.075252056 CET	465	56544	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:30.075514078 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:30.075722933 CET	56544	465	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:30.082113028 CET	5555	56546	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:30.082243919 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:30.082309961 CET	56546	5555	192.168.2.4	65.21.245.7
Oct 30, 2024 22:48:30.082895994 CET	465	56544	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:30.089365959 CET	5555	56546	65.21.245.7	192.168.2.4
Oct 30, 2024 22:48:31.007342100 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:31.051412106 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:32.023983002 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:32.067042112 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:33.038333893 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:33.082712889 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:34.054167986 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:34.098289013 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:35.056233883 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:35.098289013 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:36.161571980 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:36.207667112 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:37.058751106 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:37.113919973 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:38.074069977 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:38.113933086 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:39.089891911 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:39.129676104 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:40.105319023 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:40.160803080 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:41.121040106 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:41.176440001 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:42.121645927 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:42.176479101 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:43.137026072 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:43.192058086 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:44.152635098 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:44.207665920 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:45.168162107 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:45.223298073 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:46.183892012 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:46.238925934 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:47.199750900 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:47.254564047 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:48.215606928 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:48.270189047 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:49.230667114 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:49.288239002 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:50.246789932 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:50.301460028 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:51.432374001 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:51.473326921 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:52.250581026 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:52.301444054 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:53.250941038 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:53.303354025 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:54.266458988 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:54.317060947 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:55.282052994 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:55.332695961 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:56.297925949 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:56.348309994 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:57.313813925 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:57.364115953 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:58.328979015 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:58.379573107 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:48:59.330004930 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:48:59.379590034 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:00.345875025 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:00.395200014 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:01.361407995 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:01.410819054 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:02.377163887 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:02.426464081 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:03.392709017 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:03.442085028 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:04.412250042 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:04.457700014 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:05.410775900 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:05.457804918 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:06.413019896 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:06.457725048 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:07.414215088 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:07.457721949 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:08.429801941 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:08.473340988 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:09.445107937 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:09.492024899 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:10.445426941 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:10.489032984 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:11.461091042 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:11.504606009 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:12.476514101 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:12.520230055 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:13.492158890 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:13.535859108 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:14.492605925 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:14.535995007 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:15.508028030 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:15.551471949 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:16.507894993 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:16.551481009 CET	56361	8080	192.168.2.4	111.90.140.76
Oct 30, 2024 22:49:17.523744106 CET	8080	56361	111.90.140.76	192.168.2.4
Oct 30, 2024 22:49:17.567219973 CET	56361	8080	192.168.2.4	111.90.140.76

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:46:21.793045044 CET	56283	53	192.168.2.4	1.1.1.1
Oct 30, 2024 22:46:24.191369057 CET	53	61305	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 22:46:21.793045044 CET	192.168.2.4	1.1.1.1	0x6c6f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 22:46:21.802793026 CET	1.1.1.1	192.168.2.4	0x6c6f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	56362	111.90.140.76	80	8372	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:47:21.692001104 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:47:21.692034960 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	56364	65.21.245.7	80	8372	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:47:21.723472118 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:47:21.723472118 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:47:22.433482885 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:47:21 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:47:22.435384035 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:47:22.435384035 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:47:22.435384989 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:47:22.435457945 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	56543	111.90.140.76	80	8372	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:48:21.676492929 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:48:21.676493883 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	56545	65.21.245.7	80	8372	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:48:21.707789898 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:48:21.707823038 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:48:22.540862083 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:48:20 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:48:22.543493032 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:48:22.543493032 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:48:22.543493032 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:48:22.543577909 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	56266	96.7.168.138	443	8032	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:46:25 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-30 21:46:25 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Wed, 30 Oct 2024 21:46:25 GMT Connection: close

Target ID:	0
Start time:	17:46:06
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\0438.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0438.pdf.exe"
Imagebase:	0x7ff6c0420000
File size:	11'654'747 bytes
MD5 hash:	2D11DBA46735AF1CB1C0A42E9564E20D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:46:07
Start date:	30/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn
Imagebase:	0x7ff7ab270000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:46:07
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:46:07
Start date:	30/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7ab270000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:46:08
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:46:08
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:46:08
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1604,i,14248424182564037547,2314373854622466325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:46:15
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Imagebase:	0x7ff70f330000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000000.1777309138.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:46:16
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000000.1786776059.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:46:17
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:46:17
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:46:18
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:46:19
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:46:19
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:46:21
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	17:46:21
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF6C044B190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C042255C: GetDlgItem.USER32 ref: 00007FF6C04225AC
Part of subcall function 00007FF6C042255C: SetWindowTextW.USER32 ref: 00007FF6C04225C8

EndDialog.USER32 ref: 00007FF6C044B2D0
SetDlgItemTextW.USER32 ref: 00007FF6C044B320
GetMessageW.USER32 ref: 00007FF6C044B350
IsDialogMessageW.USER32 ref: 00007FF6C044B369
TranslateMessage.USER32 ref: 00007FF6C044B37B
DispatchMessageW.USER32 ref: 00007FF6C044B389
EndDialog.USER32 ref: 00007FF6C044B3D3
GetDlgItem.USER32 ref: 00007FF6C044B410
SendMessageW.USER32 ref: 00007FF6C044B431
SendMessageW.USER32 ref: 00007FF6C044B449
SetFocus.USER32 ref: 00007FF6C044B452
GetLastError.KERNEL32 ref: 00007FF6C044B634
GetLastError.KERNEL32 ref: 00007FF6C044B665
GetTickCount.KERNEL32 ref: 00007FF6C044B68B
GetLastError.KERNEL32 ref: 00007FF6C044B6F5
GetCommandLineW.KERNEL32 ref: 00007FF6C044B841
CreateFileMappingW.KERNEL32 ref: 00007FF6C044B900
MapViewOfFile.KERNEL32 ref: 00007FF6C044B923
Sleep.KERNEL32 ref: 00007FF6C044B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF6C044B9DF
CloseHandle.KERNEL32 ref: 00007FF6C044B9E8
SetDlgItemTextW.USER32 ref: 00007FF6C044BCDE
DialogBoxParamW.USER32 ref: 00007FF6C044C0D7
EndDialog.USER32 ref: 00007FF6C044C0EF
EnableWindow.USER32 ref: 00007FF6C044C2A6
SendMessageW.USER32 ref: 00007FF6C044C2F8
ShellExecuteExW.SHELL32 ref: 00007FF6C044B95B

Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB67
Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB80

SendMessageW.USER32 ref: 00007FF6C044BEC3
SendDlgItemMessageW.USER32 ref: 00007FF6C044BEEA
GetDlgItem.USER32 ref: 00007FF6C044BEF8
SendMessageW.USER32 ref: 00007FF6C044BF12
GetDlgItem.USER32 ref: 00007FF6C044BF4F
SetDlgItemTextW.USER32 ref: 00007FF6C044BFEC
SetDlgItemTextW.USER32 ref: 00007FF6C044C004
SetDlgItemTextW.USER32 ref: 00007FF6C044C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044C381
SendDlgItemMessageW.USER32 ref: 00007FF6C044C449
EndDialog.USER32 ref: 00007FF6C044C463
GetDlgItem.USER32 ref: 00007FF6C044C491
SetFocus.USER32 ref: 00007FF6C044C49A
SendDlgItemMessageW.USER32 ref: 00007FF6C044C53E
FindFirstFileW.KERNEL32 ref: 00007FF6C044C562
FindClose.KERNEL32 ref: 00007FF6C044C68A
SendDlgItemMessageW.USER32 ref: 00007FF6C044C7AF

Part of subcall function 00007FF6C042129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0421396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044CAC7

Strings

p, xrefs: 00007FF6C044B7AB
runas, xrefs: 00007FF6C044B7C9
LICENSEDLG, xrefs: 00007FF6C044C0C9
@, xrefs: 00007FF6C044B7B6
__tmp_rar_sfx_access_check_, xrefs: 00007FF6C044B6A9
winrarsfxmappingfile.tmp, xrefs: 00007FF6C044B8E0
STARTDLG, xrefs: 00007FF6C044B1CA
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6C044B799
REPLACEFILEDLG, xrefs: 00007FF6C044C3D3
%s %s, xrefs: 00007FF6C044C6D9, 00007FF6C044C946

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 9a17fb0a367c8f41df10969568811eb98f7642249842cc7a5319212f9cbedbf3
Instruction ID: e3797a2ca0368b8e5100ba40153c191472a5799e3f21ae05277730ccb06226fb
Opcode Fuzzy Hash: 9a17fb0a367c8f41df10969568811eb98f7642249842cc7a5319212f9cbedbf3
Instruction Fuzzy Hash: 9ED29362A08682F1EA609F65E8542FB6361EF85782F40C636DACDC77A6DF3CE544C740

Function 00007FF6C044CE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C044D5F3
SendMessageW.USER32 ref: 00007FF6C044D626
SendMessageW.USER32 ref: 00007FF6C044D655
MoveFileW.KERNEL32 ref: 00007FF6C044DB4B
MoveFileExW.KERNEL32 ref: 00007FF6C044DB69
GetTempPathW.KERNEL32 ref: 00007FF6C044DC49

Part of subcall function 00007FF6C0421FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421FFB

EndDialog.USER32 ref: 00007FF6C044DFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C044EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C044EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C044EF73

Strings

.tmp, xrefs: 00007FF6C044DA85
ProgramFilesDir, xrefs: 00007FF6C044D4F0
@set:user, xrefs: 00007FF6C044DD96, 00007FF6C044DDA5
lnk, xrefs: 00007FF6C044E3CA, 00007FF6C044E3D9
HIDE, xrefs: 00007FF6C044E9E5, 00007FF6C044E9F4
<br>, xrefs: 00007FF6C044D6DA, 00007FF6C044D6E9
MIN, xrefs: 00007FF6C044EAE5, 00007FF6C044EAF4
MAX, xrefs: 00007FF6C044EA82, 00007FF6C044EA91
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6C044D501
.lnk, xrefs: 00007FF6C044E406, 00007FF6C044E415

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 13eb6110c4e0ac35ec007d1b6c7a4b17d7f990185731ca232e56026f253a956b
Instruction ID: e4e9528c4daf63297db279c455dd3ca1ff7142ae1d82f2003de82fff48313e5f
Opcode Fuzzy Hash: 13eb6110c4e0ac35ec007d1b6c7a4b17d7f990185731ca232e56026f253a956b
Instruction Fuzzy Hash: 5013BD72B04A82F4EB10DFA4D8442EE27A1EB44799F509536DA9DD7BE9DF38E184C340

Function 00007FF6C0450754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C043DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E018
Part of subcall function 00007FF6C043DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E030
Part of subcall function 00007FF6C043DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E05D

Part of subcall function 00007FF6C04362DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C04362F2
Part of subcall function 00007FF6C04362DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C043632C

Part of subcall function 00007FF6C044946C: OleInitialize.OLE32 ref: 00007FF6C0449486
Part of subcall function 00007FF6C044946C: SHGetMalloc.SHELL32 ref: 00007FF6C04494D4

GetCommandLineW.KERNEL32 ref: 00007FF6C045096E
OpenFileMappingW.KERNEL32 ref: 00007FF6C0450A07
MapViewOfFile.KERNEL32 ref: 00007FF6C0450A30
UnmapViewOfFile.KERNEL32 ref: 00007FF6C0450A46
MapViewOfFile.KERNEL32 ref: 00007FF6C0450A63
UnmapViewOfFile.KERNEL32 ref: 00007FF6C0450ACA
CloseHandle.KERNEL32 ref: 00007FF6C0450AD3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6C0450BAD
GetLocalTime.KERNEL32 ref: 00007FF6C0450BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C0450C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C0450C26
GetModuleHandleW.KERNEL32 ref: 00007FF6C0450C2E
LoadIconW.USER32 ref: 00007FF6C0450C4D
DialogBoxParamW.USER32 ref: 00007FF6C0450CB6
Sleep.KERNEL32 ref: 00007FF6C0450CE6
DeleteObject.GDI32 ref: 00007FF6C0450D0D
DeleteObject.GDI32 ref: 00007FF6C0450D1F
CloseHandle.KERNEL32 ref: 00007FF6C0450D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0450DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0450DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0450DE3

Part of subcall function 00007FF6C044FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C044FD43
Part of subcall function 00007FF6C044FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C044FDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6C0450C02
sfxname, xrefs: 00007FF6C0450B9B
sfxstime, xrefs: 00007FF6C0450C1F
winrarsfxmappingfile.tmp, xrefs: 00007FF6C04509F9
STARTDLG, xrefs: 00007FF6C0450CA5

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction ID: dcb92f907ff0c0bc1bac1f14561b3d7810a9aaefd0a850b720165890a6099d2a
Opcode Fuzzy Hash: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction Fuzzy Hash: 79129F75A08B82E1EB109F24E8552BA7361FF85786F408636DADDC6BA5EF3CE144C740

Function 00007FF6C043A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C043A504

Part of subcall function 00007FF6C0440F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6C0440F99

SetDlgItemTextW.USER32 ref: 00007FF6C043A573
GetWindowRect.USER32 ref: 00007FF6C043A5AD
GetClientRect.USER32 ref: 00007FF6C043A5BB
GetWindowLongPtrW.USER32 ref: 00007FF6C043A66C
GetWindowRect.USER32 ref: 00007FF6C043A6B2
SetWindowTextW.USER32 ref: 00007FF6C043A6EC
GetSystemMetrics.USER32 ref: 00007FF6C043A6F7
GetWindow.USER32 ref: 00007FF6C043A708
GetWindowRect.USER32 ref: 00007FF6C043A746
GetWindow.USER32 ref: 00007FF6C043A808

Strings

CAPTION, xrefs: 00007FF6C043A6CF
$%s:, xrefs: 00007FF6C043A4EF

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 8889b5b63a0849ff5d2543be9371cae9d6d43ab336bd5238a6592f39c5af6d85
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 3B91D732B18641D6E718DF2AE80066AA7A1FB89785F549535EE8DC7B58CF3CE805CB40

Function 00007FF6C0448624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF6C044863D
SizeofResource.KERNEL32 ref: 00007FF6C0448659
LoadResource.KERNEL32 ref: 00007FF6C0448673
LockResource.KERNEL32 ref: 00007FF6C0448685
GlobalAlloc.KERNELBASE ref: 00007FF6C04486A6
GlobalLock.KERNEL32 ref: 00007FF6C04486BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF6C04486E8
GdipAlloc.GDIPLUS ref: 00007FF6C04486FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C0448769
GlobalUnlock.KERNEL32 ref: 00007FF6C044878C
GlobalFree.KERNEL32 ref: 00007FF6C0448795

Strings

PNG, xrefs: 00007FF6C044862F

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: d43017f1dbd007baa9b971289a69e4e2f99db6646163dbeeda9938b247fcd3cb
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 2F413F25B19B06E1EF048F56D86437A63A0AF88B96F148539CE8DC7364EF7CE4488740

Function 00007FF6C042F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431263

Strings

__tmp_reference_source_, xrefs: 00007FF6C042FCCF, 00007FF6C042FCDE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction ID: 529b308386112a7a6f0bf1a0e30892a6b843d6d0d11e6c430abb616de4aab54f
Opcode Fuzzy Hash: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction Fuzzy Hash: 37E27262A08AC2E2EA648F65E1543AF6761FB85782F409232DBDDD37A5CF3CE455C700

Function 00007FF6C0424840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0425124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0425E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0425E1C

Strings

CMT, xrefs: 00007FF6C04259B2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 900f1335872eede1b1a492564cf610b08fbb687fb420bf81384da2f580c8fe8c
Instruction ID: d6f33fcceed6be2225d5c8a3f5f95a352dbb25d0e36d89207b504d5cec430582
Opcode Fuzzy Hash: 900f1335872eede1b1a492564cf610b08fbb687fb420bf81384da2f580c8fe8c
Instruction Fuzzy Hash: E1E2DB62B08682E6EB18DF6595582FEA7A1FB84785F408036DA9EC3796DF3CE554C300

Function 00007FF6C04340BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6C043410B
FindFirstFileW.KERNELBASE ref: 00007FF6C043415E
GetLastError.KERNEL32 ref: 00007FF6C04341AF
FindNextFileW.KERNEL32 ref: 00007FF6C04341D7
GetLastError.KERNEL32 ref: 00007FF6C04341E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0434315

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: eb50b094e72780ee953a20575587fcce460078097343a97e79d0487ad9417f97
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: 06618362A08A46E1EE109F24E4442AA6361FB997B5F109331EAEDC37D9DF3CE584C700

Function 00007FF6C0425E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6C04259B2, 00007FF6C042675B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction ID: 7a4375f56bc5073d881bbb44e90746fca32a1f76bde79ade84ac53f3447b7cfe
Opcode Fuzzy Hash: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction Fuzzy Hash: D042CA62B08682EAEB18DF74D1442FE67A5EB55389F008136DB9ED3796DF38E558C300

Function 00007FF6C0441F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction ID: b0292e54368d2fcd1f452a26dd927ec155543c7f057e201207c6638f9d6caadc
Opcode Fuzzy Hash: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction Fuzzy Hash: 11E1D162A08282EAEB64CF69A0442AE7B91FB84749F058139DBCED7785DF3CE5458704

Function 00007FF6C0443484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction ID: 2808b229257f928f63c3918820270c32b30217b1bbab1d457933055dd3b82c08
Opcode Fuzzy Hash: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction Fuzzy Hash: 37B1C1A2B08AC9B2DE58DEA595086EAA392B744FC6F44C436DE9D87741DF3CE155C300

Function 00007FF6C0434928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction ID: 7cf288ac30d7202457dbc6abba32ddd1e6ed7f1b2d89e8e763fd7487d132d6e5
Opcode Fuzzy Hash: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction Fuzzy Hash: 5741F622B15656D6FA64EF22A9417AB2252FBC8785F04E031DE8EC7794DF3CF4468704

Function 00007FF6C043DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E05D
CreateFileW.KERNEL32 ref: 00007FF6C043E3F0
SetFilePointer.KERNEL32 ref: 00007FF6C043E40E
ReadFile.KERNEL32 ref: 00007FF6C043E436

Part of subcall function 00007FF6C043DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C043DDDF

CompareStringW.KERNELBASE ref: 00007FF6C043E559
CloseHandle.KERNEL32 ref: 00007FF6C043E4F3

Part of subcall function 00007FF6C0421FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421FFB

Part of subcall function 00007FF6C04351A4: GetVersionExW.KERNEL32 ref: 00007FF6C04351D5

Part of subcall function 00007FF6C043DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF6C043DEFF
Part of subcall function 00007FF6C043DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043DFB5
Part of subcall function 00007FF6C043DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043DFBB
Part of subcall function 00007FF6C043DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043DFC1
Part of subcall function 00007FF6C043DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C043E7AA
ExitProcess.KERNEL32 ref: 00007FF6C043E7BB

Strings

samlib.dll, xrefs: 00007FF6C043E2D7
slc.dll, xrefs: 00007FF6C043E23D
dhcpcsvc6.dll, xrefs: 00007FF6C043E31D
SetDllDirectoryW, xrefs: 00007FF6C043E026
cryptbase.dll, xrefs: 00007FF6C043E0C8
userenv.dll, xrefs: 00007FF6C043E15D
mlang.dll, xrefs: 00007FF6C043E2BB
shell32.dll, xrefs: 00007FF6C043E1BF
samcli.dll, xrefs: 00007FF6C043E2C9
browcli.dll, xrefs: 00007FF6C043E301
atl.dll, xrefs: 00007FF6C043E136
ws2help.dll, xrefs: 00007FF6C043E10A
rsaenh.dll, xrefs: 00007FF6C043E0A7
dhcpcsvc.dll, xrefs: 00007FF6C043E32B
mpr.dll, xrefs: 00007FF6C043E291
DXGIDebug.dll, xrefs: 00007FF6C043E086, 00007FF6C043E5B6
netapi32.dll, xrefs: 00007FF6C043E16B
propsys.dll, xrefs: 00007FF6C043E2AD
psapi.dll, xrefs: 00007FF6C043E115
lpk.dll, xrefs: 00007FF6C043E0D3
uxtheme.dll, xrefs: 00007FF6C043E66D
apphelp.dll, xrefs: 00007FF6C043E14F
devrtl.dll, xrefs: 00007FF6C043E29F
wkscli.dll, xrefs: 00007FF6C043E2E5
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6C043E73B
SetDefaultDllDirectories, xrefs: 00007FF6C043E053
dsrole.dll, xrefs: 00007FF6C043E37F
secur32.dll, xrefs: 00007FF6C043E1CD
dnsapi.DLL, xrefs: 00007FF6C043E259
cscapi.dll, xrefs: 00007FF6C043E22F
aclui.dll, xrefs: 00007FF6C043E371
cryptui.dll, xrefs: 00007FF6C043E1A3
netutils.dll, xrefs: 00007FF6C043E283
ws2_32.dll, xrefs: 00007FF6C043E0FF
ieframe.dll, xrefs: 00007FF6C043E120
crypt32.dll, xrefs: 00007FF6C043E187
oleaccrc.dll, xrefs: 00007FF6C043E1E9
peerdist.dll, xrefs: 00007FF6C043E38D
cryptsp.dll, xrefs: 00007FF6C043E355
dwmapi.dll, xrefs: 00007FF6C043E0BD, 00007FF6C043E661
kernel32, xrefs: 00007FF6C043E011
WindowsCodecs.dll, xrefs: 00007FF6C043E213
comres.dll, xrefs: 00007FF6C043E0F4
ntmarta.dll, xrefs: 00007FF6C043E1F7
linkinfo.dll, xrefs: 00007FF6C043E347
SSPICLI.DLL, xrefs: 00007FF6C043E09C
version.dll, xrefs: 00007FF6C043E07B
rasadhlp.dll, xrefs: 00007FF6C043E30F
cabinet.dll, xrefs: 00007FF6C043E1DB
msasn1.dll, xrefs: 00007FF6C043E195
imageres.dll, xrefs: 00007FF6C043E24B
UXTheme.dll, xrefs: 00007FF6C043E0B2
RpcRtRemote.dll, xrefs: 00007FF6C043E363
setupapi.dll, xrefs: 00007FF6C043E141
iphlpapi.DLL, xrefs: 00007FF6C043E267
sfc_os.dll, xrefs: 00007FF6C043E091
srvcli.dll, xrefs: 00007FF6C043E221
clbcatq.dll, xrefs: 00007FF6C043E0E9
shdocvw.dll, xrefs: 00007FF6C043E179
XmlLite.dll, xrefs: 00007FF6C043E339
usp10.dll, xrefs: 00007FF6C043E0DE
profapi.dll, xrefs: 00007FF6C043E205
ntshrui.dll, xrefs: 00007FF6C043E12B
wintrust.dll, xrefs: 00007FF6C043E1B1
WINNSI.DLL, xrefs: 00007FF6C043E275
dfscli.dll, xrefs: 00007FF6C043E2F3

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction ID: 2d2036e55c6204110898b39b9cc903536dba2ce798ef9b80a71d8cf718dc8a47
Opcode Fuzzy Hash: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction Fuzzy Hash: BC322A31A09B82E9EB119F60E8401EA33A8FF49356F509236DA8DC77A5EF7CD655C340

Function 00007FF6C04398DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0438E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0438F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C0439F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043A435

Part of subcall function 00007FF6C0440BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6C0440B44), ref: 00007FF6C0440BE9

Strings

MENU, xrefs: 00007FF6C0439DD9
DIRECTION, xrefs: 00007FF6C0439DE5
@%s:, xrefs: 00007FF6C0439F57
$%s:, xrefs: 00007FF6C0439F50
,, xrefs: 00007FF6C0439FAA
RTL, xrefs: 00007FF6C0439F2E
*messages***, xrefs: 00007FF6C0439C04
*messages***, xrefs: 00007FF6C0439BC6
STRINGS, xrefs: 00007FF6C0439DC1
, xrefs: 00007FF6C0439DF9
DIALOG, xrefs: 00007FF6C0439DCD

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction ID: 00917d9c77a3b6fefd4cb295e19df7a16d18d6ec8987be798a5025505cd96d24
Opcode Fuzzy Hash: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction Fuzzy Hash: 6162AB22A19682E5EB10DF24D4482BF6365FB48789F80A136DA9EC77D5EF3CE954C340

Function 00007FF6C0451900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C0451558: DloadProtectSection.DELAYIMP ref: 00007FF6C04515C9

RaiseException.KERNEL32 ref: 00007FF6C04519A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C0451993

Part of subcall function 00007FF6C0451868: DloadProtectSection.DELAYIMP ref: 00007FF6C04518C7

LoadLibraryExA.KERNELBASE ref: 00007FF6C0451A46
GetLastError.KERNEL32 ref: 00007FF6C0451A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C0451A86
RaiseException.KERNEL32 ref: 00007FF6C0451A9A

Strings

H, xrefs: 00007FF6C0451974

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 56e8a08039ff9c9d0ceecf635a42ec6989085f410060e9fcf84eec5a8b77b0f9
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 4F913A36A05B52EAEB10CF65D8446AE33B1BB08B9AF058539DE8DD7764EF38E445C340

Function 00007FF6C044F4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6C044F747
ShowWindow.USER32 ref: 00007FF6C044F786
GetExitCodeProcess.KERNEL32 ref: 00007FF6C044F7BD
CloseHandle.KERNEL32 ref: 00007FF6C044F7E7
ShowWindow.USER32 ref: 00007FF6C044F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044F8FB

Strings

Install, xrefs: 00007FF6C044F684
.inf, xrefs: 00007FF6C044F675
p, xrefs: 00007FF6C044F529
.exe, xrefs: 00007FF6C044F7F2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction ID: 49428e8b15acdcdf7226e169e9b07f2e5961b3f3d157d2b4e28ed05a5e62f159
Opcode Fuzzy Hash: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction Fuzzy Hash: 81C18E62F18A12F5FB01DFA5D95427A23A1AF85B82F048532DE8DC77A5EF3CE5518340

Function 00007FF6C044F0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C044AE1C: PeekMessageW.USER32 ref: 00007FF6C044AE32
Part of subcall function 00007FF6C044AE1C: GetMessageW.USER32 ref: 00007FF6C044AE49
Part of subcall function 00007FF6C044AE1C: IsDialogMessageW.USER32 ref: 00007FF6C044AE60
Part of subcall function 00007FF6C044AE1C: TranslateMessage.USER32 ref: 00007FF6C044AE6F
Part of subcall function 00007FF6C044AE1C: DispatchMessageW.USER32 ref: 00007FF6C044AE7A

GetDlgItem.USER32 ref: 00007FF6C044F0E3
ShowWindow.USER32 ref: 00007FF6C044F109
SendMessageW.USER32 ref: 00007FF6C044F11E
SendMessageW.USER32 ref: 00007FF6C044F136
SendMessageW.USER32 ref: 00007FF6C044F157
SendMessageW.USER32 ref: 00007FF6C044F173
SendMessageW.USER32 ref: 00007FF6C044F1B6
SendMessageW.USER32 ref: 00007FF6C044F1D4
SendMessageW.USER32 ref: 00007FF6C044F1E8
SendMessageW.USER32 ref: 00007FF6C044F212
SendMessageW.USER32 ref: 00007FF6C044F22A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: 7985dbc0910b4628d6754b1be62f2a787916f1ff56ec3b79e1edf3e76971c6bf
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: A041E431B14742E6F710CF62E810BAB2360EB45B89F448636DD8ACBB95CF3DD8458780

Function 00007FF6C042EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F572

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction ID: a56762ccd302fe7e670725b1bc89007a6e012f63c53744ea488d4deb740808a2
Opcode Fuzzy Hash: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction Fuzzy Hash: 56129162B08B41E5EA10DF65D4482AE2371AB457A9F808236DE9CD7BDADF3CE585C340

Function 00007FF6C04324C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6C043259B
GetLastError.KERNEL32 ref: 00007FF6C04325AE
CreateFileW.KERNEL32 ref: 00007FF6C043260E
GetLastError.KERNEL32 ref: 00007FF6C0432617
SetFileTime.KERNEL32 ref: 00007FF6C04326C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0432736

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: d4f255821227257c66b022b021d6bf8e9a6c3bd14cb63aafc7008dae67881e6f
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: 7E61D0B6A18641D6E7208F29E50136F77B1BB897A8F109324DFA983BD8DF3DD0588740

Function 00007FF6C044B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6C044B02A
GetObjectW.GDI32 ref: 00007FF6C044B05B
DeleteObject.GDI32 ref: 00007FF6C044B095
DeleteObject.GDI32 ref: 00007FF6C044B0C5

Part of subcall function 00007FF6C0448624: FindResourceW.KERNEL32 ref: 00007FF6C044863D
Part of subcall function 00007FF6C0448624: SizeofResource.KERNEL32 ref: 00007FF6C0448659
Part of subcall function 00007FF6C0448624: LoadResource.KERNEL32 ref: 00007FF6C0448673
Part of subcall function 00007FF6C0448624: LockResource.KERNEL32 ref: 00007FF6C0448685
Part of subcall function 00007FF6C0448624: GlobalAlloc.KERNELBASE ref: 00007FF6C04486A6
Part of subcall function 00007FF6C0448624: GlobalLock.KERNEL32 ref: 00007FF6C04486BB
Part of subcall function 00007FF6C0448624: CreateStreamOnHGlobal.COMBASE ref: 00007FF6C04486E8
Part of subcall function 00007FF6C0448624: GdipAlloc.GDIPLUS ref: 00007FF6C04486FE
Part of subcall function 00007FF6C0448624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C0448769
Part of subcall function 00007FF6C0448624: GlobalUnlock.KERNEL32 ref: 00007FF6C044878C
Part of subcall function 00007FF6C0448624: GlobalFree.KERNEL32 ref: 00007FF6C0448795

Strings

], xrefs: 00007FF6C044B063

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 05d8647613b621eeb0ad3f36c382337f68a7f6de2c40fa669932c5a5386a8f6f
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 64119620B09242F1FA64DF62964427B5291AF89BC2F088538DD9DC7B96DF3CE8048B40

Function 00007FF6C044AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6C044AE32
GetMessageW.USER32 ref: 00007FF6C044AE49
IsDialogMessageW.USER32 ref: 00007FF6C044AE60
TranslateMessage.USER32 ref: 00007FF6C044AE6F
DispatchMessageW.USER32 ref: 00007FF6C044AE7A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 2db38a21b8929f69becde762dfeaa5974c514141b739e07c7a74c8d2c233c22b
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 7EF0EC25B38942E2FB509F61E899E372361BFD0B06F849932E58EC6A54DF3CD518CB40

Function 00007FF6C04491E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6C0449211
SHAutoComplete.SHLWAPI ref: 00007FF6C0449255

Part of subcall function 00007FF6C04413C4: CompareStringW.KERNEL32 ref: 00007FF6C04413E3

FindWindowExW.USER32 ref: 00007FF6C044923F

Strings

EDIT, xrefs: 00007FF6C044921B, 00007FF6C0449233

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 65bc63fc2dc0b64775ea6ec9e7b605f74b182b185efdf757ddd29adf37a39aca
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: DE016D21B18A83F1FA209F62E8157B76390BF99B42F448532CD8DCA754EF3CE5499B40

Function 00007FF6C0432CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6C0438C9A), ref: 00007FF6C0432D22
WriteFile.KERNEL32 ref: 00007FF6C0432D6C
WriteFile.KERNELBASE ref: 00007FF6C0432D9A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: 91ba2d33a05bf91334a6681b184eb2c9aff1fd11cd77a1046972584b71e16b13
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: C251E372A19A42E2EA508F25D54577B3360EB88B96F149135EB8DC7B90DF3CE485C700

Function 00007FF6C04503E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF6C0450556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04505C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04505C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04505CD

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction ID: 6a314fe7b2e3f51552d991305149f707133286bb6c8dc2426a6f35de5c182da6
Opcode Fuzzy Hash: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction Fuzzy Hash: E451CFBAF14656E4FB00DFA4D8442AE3362AF45B96F408636DA9DD6BD5EF6CD040C300

Function 00007FF6C0452D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6C0452D7B

Part of subcall function 00007FF6C04527FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6C045281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C0452D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C0452DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6C0452E51

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 033c2a133c09a6ed73bdca54943fe77f65718a2862598e3f34b5ea64ebe50778
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: AE31F839A0C106F6FA54AF6495523BB3291AF46746F44D53AEACECB3D3DF2CA8048351

Function 00007FF6C0433684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF6C043309D), ref: 00007FF6C04336CE
CreateDirectoryW.KERNEL32 ref: 00007FF6C0433733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6C043309D), ref: 00007FF6C0433791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04337CE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 6dccdc97f88b2c62d1da588f07cb06f04140fdde165f97f6254ab29b709633b9
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: 7431A0A6A0C682E1EA209F25A54527F6362BF8D7A2F50D231EEDDC3795DF3CD4458700

Function 00007FF6C0432320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6C0432927,?,00100000,?,00000001,00000000,00000000,?,00007FF6C04314C1), ref: 00007FF6C0432348
ReadFile.KERNELBASE ref: 00007FF6C0432367
GetLastError.KERNEL32 ref: 00007FF6C043239B
GetLastError.KERNEL32 ref: 00007FF6C04323BA

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 4d95485a7e3dffd932f79107cd4c0a55133f93f2a181fdbc39ed0f95fc806d1f
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: CD217F31A0C652E1EA609F21A50023B73A0FB49B96F14A534DFDDC7788DF7CD8858711

Function 00007FF6C043E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C043ECD8: ResetEvent.KERNEL32 ref: 00007FF6C043ECF1
Part of subcall function 00007FF6C043ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF6C043ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF6C043E974
CloseHandle.KERNELBASE ref: 00007FF6C043E993
DeleteCriticalSection.KERNEL32 ref: 00007FF6C043E9AA
CloseHandle.KERNEL32 ref: 00007FF6C043E9B7

Part of subcall function 00007FF6C043EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C043E95F,?,?,?,00007FF6C043463A,?,?,?), ref: 00007FF6C043EA63
Part of subcall function 00007FF6C043EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C043E95F,?,?,?,00007FF6C043463A,?,?,?), ref: 00007FF6C043EA6E

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: e75f21966f9bdaab4368dc053916cb3206eebefd8528b05d695e56a23e38bdc3
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 24012D32A15A81E3E6489F21E5446AEB330FB88B91F009135DB9DC3765CF39E4B98740

Function 00007FF6C043EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6C043EAE0
SetThreadPriority.KERNEL32 ref: 00007FF6C043EB36

Strings

CreateThread failed, xrefs: 00007FF6C043EAEE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: d67cafd05cee08924439fe09096c587507c5339fc827c3f8d21e365a55ff7e3d
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: A5114C31A19A42E1E601DF11E8416ABB360FB84786F54C636D68DC2769EF7CE541CB40

Function 00007FF6C044946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C043DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C043DDDF

OleInitialize.OLE32 ref: 00007FF6C0449486
SHGetMalloc.SHELL32 ref: 00007FF6C04494D4

Strings

riched20.dll, xrefs: 00007FF6C0449475

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 79339383799d83bbb8a7e05eb3068e9f7109f9916310bd5bd5260bf0aae17d14
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 2EF04F71618B41D2EB019F20F41456BB3A0FB89755F408636EACDC6754DF7CD159CB40

Function 00007FF6C044095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C044853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6C044856C

Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB67
Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB80

Part of subcall function 00007FF6C0421FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421FFB

Part of subcall function 00007FF6C042129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0421396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04501BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04501C1
SendDlgItemMessageW.USER32 ref: 00007FF6C04501F2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction ID: 87253d214ec31c0067bd0d7b8ebf174f8f71415ffa96af1f7d0412e8e19b9ceb
Opcode Fuzzy Hash: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction Fuzzy Hash: 8451C076F04A42E6FB109FA1D4452FE2362AB89B85F408236DE9ED7796DF2CD500C340

Function 00007FF6C0432134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6C04321CF
CreateFileW.KERNEL32 ref: 00007FF6C043223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04322D8

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: b4a3a4d6f169ab4e220173622d398c1368545e94b083c280c3bbebae591a9a00
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: 98418072A18682E2EA108F15E54426A73A1FB897B5F109735DFED87BD5CF3CE4948700

Function 00007FF6C04223F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6C042243E
GetWindowTextW.USER32 ref: 00007FF6C0422476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0422505

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: c9d820d30afcb1fd420f8e453d3a3a10d7f8cb7347dbc42f22ab7f201caf2a1a
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: 33219E72A18B81D1EA108F25A54016AB364FB89BD1F148236EFDDC3B95CF3CD1808740

Function 00007FF6C0441F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C044205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0442077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0442093

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction ID: 8b32b2c6cd07656b1d30e06f648ce2e7d68b2166ce948b222875a46deb7c086e
Opcode Fuzzy Hash: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction Fuzzy Hash: 55314122A09A86F1FB249F54E5443BA63A0FB50B85F54C431E7CCC6BA9DF6CE956C301

Function 00007FF6C0433D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6C04407E1), ref: 00007FF6C0433D5E
SetFileAttributesW.KERNEL32 ref: 00007FF6C0433DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0433E1A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: e85475e530a2b054e5d2f68f3bc6c727d5010e97c8ec9401b6ba9f3908c56376
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: 2A21B362A1CA81D1EA209F25E44526B6362FF89B96F109234EEDEC3795EF3CD544CB00

Function 00007FF6C04331BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF6C0440822), ref: 00007FF6C04331E7
DeleteFileW.KERNEL32 ref: 00007FF6C0433237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04332A1

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: 2951c3e8c105ceb24fc730ebc91d920261577c7a302a055b75f9e99abaf6af5d
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: EC21A172A1C781D1EA108F25E44426F7361FB89B96F509235EADEC7B99DF2CD540C700

Function 00007FF6C04332BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6C043E5B1,?,?,?,00000000,?), ref: 00007FF6C04332E7
GetFileAttributesW.KERNELBASE ref: 00007FF6C0433334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0433399

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: e008c27a0911627fb8aeb5b79de0ed44f36d67a90247aa8930925f3bd67b918e
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: 98216072A18A81D1EA109F29E44422B6361FB89BA6F509331EADDC3BA5DF3CD544C700

Function 00007FF6C045BF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6C045BF48), ref: 00007FF6C045BF8C
TerminateProcess.KERNEL32(?,?,?,00007FF6C045BF48), ref: 00007FF6C045BF97
ExitProcess.KERNEL32 ref: 00007FF6C045BFA6

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: d811d23ed97ea99776f92dc128ca54b549146189d6c72a45d09a4358da2bd26c
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 01E01A39A08706E6EA546F219C953BB23626F98B43F10853CC88AC2396DF3DA4498B41

Function 00007FF6C042F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042F89B

Part of subcall function 00007FF6C0433EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6C0440811), ref: 00007FF6C0433EFD

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: c851e9ba04b89524686dcd5c2666f728f32a2a2025563ce38f6b7d0a4701346e
Instruction ID: 30429891895b4c8c8ef8116e9b90e547eafb1f3c0f716652a9fd6066b0a121ad
Opcode Fuzzy Hash: c851e9ba04b89524686dcd5c2666f728f32a2a2025563ce38f6b7d0a4701346e
Instruction Fuzzy Hash: CE918073B18A91E0EB10DF64D4482AE6361FB84799F908136EA9CC7BE9DF78D585C700

Function 00007FF6C0423904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0423AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0423AB9

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction ID: 01e1a275ec26671d2d54f850e8ab0340dea0a992c133ba1379a3262950c92ba5
Opcode Fuzzy Hash: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction Fuzzy Hash: 6341A162F18651E4FB04DEB1D4442AE2371AF45BDAF149235DE9DE7B9ADF38D4828300

Function 00007FF6C0432778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6C043274D), ref: 00007FF6C04328A9
GetLastError.KERNEL32(?,00007FF6C043274D), ref: 00007FF6C04328B8

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 766181e596f7f4fc52b41bdd5303c33534b91c0da7b6d1a069bbcd50c783ab9c
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: E8319632B19A52E2EA645F2ADA4067A3350AF08BD6F14A231DF9DD7790DF3CD5418740

Function 00007FF6C04222BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C04222F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04223F0

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: 3a92bcda6c56ee09829ee20cd29bec6f8de04e79cd528e17440acb55212c3487
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: 5031AD62B18B45E2EA208F25E54836BB360EB84B91F408235EBDCC7BA5DF3CE1408700

Function 00007FF6C0432AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6C0432AFE
SetFileTime.KERNELBASE ref: 00007FF6C0432B9B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 0649fa87a9bb5dfaf42952746ee786d5ec8c253689ec93bf4f7d779842a07b69
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: B3218D32A09B42F1EA628E11D6047BBA790AB09796F15A131DF8CC7395EF3CE586C300

Function 00007FF6C043AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6C043AB67
LoadStringW.USER32 ref: 00007FF6C043AB80

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 82a9182d6911ef4c81f895052d4858214440228d44017dee65dc72b65b4aec61
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 3E118E71B18641D5EA448F16A88002AB7A1BB88FC2F548A36CA9DD3721DF7CE5518384

Function 00007FF6C0432BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6C0432C11
GetLastError.KERNEL32 ref: 00007FF6C0432C1E

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 99956c95f3fe1d4459b877845c020f63753bb1fa60f0e6c13a70f4e0c7b90547
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 94118E31A18642E1EB608F25E94026E7360FB49BA6F54A731DBADC73D5DF2CE586C700

Function 00007FF6C042255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C043A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C043A504
Part of subcall function 00007FF6C043A4AC: SetDlgItemTextW.USER32 ref: 00007FF6C043A573
Part of subcall function 00007FF6C043A4AC: GetWindowRect.USER32 ref: 00007FF6C043A5AD
Part of subcall function 00007FF6C043A4AC: GetClientRect.USER32 ref: 00007FF6C043A5BB

GetDlgItem.USER32 ref: 00007FF6C04225AC
SetWindowTextW.USER32 ref: 00007FF6C04225C8

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 1d28ac48d2904d7acbc9a3454dcd18c77fa44aa1c7f1de7d5d9ef8b9b21d2d0d
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 60019A20B0924AF1FE595F52A16827B1391AF85742F08C136C9CDCA39AEF2CE8C48300

Function 00007FF6C043EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6C043EBAD,?,?,?,?,00007FF6C0435752,?,?,?,00007FF6C04356DE), ref: 00007FF6C043EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF6C043EB6F

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: c467a87ac0e8fcfb248588b942ca3c787f2a9142bb6a60aae2ae7065f24da01e
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: CAE0E561B1858AD2DF098F56C4508EAA3A2BF88B40F84D135E64BC3714EF2CE1498B00

Function 00007FF6C04521D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0452200

Part of subcall function 00007FF6C0452F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0452F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0452206

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: be7242b336c55cf4caa62814d5f8ce3daa6f609a03a7369dedb40604216ac939
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: 9DE0EC69E09507E1F9582A621A261B720500F2A772E1CD731EBFEC57D2AF1CA4918750

Function 00007FF6C045D90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6C045D922
GetLastError.KERNEL32 ref: 00007FF6C045D934

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: d9a768b448c4766bcc4e323fc4ba778ac4ef21e9a586c8de3356e49120805be3
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: D7E0BF64E49503E6FF256FB258551B623916F94756B048534C98DC6352EF2C94858700

Function 00007FF6C04233E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042388C

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction ID: 6a2f544d667caf04c211638c1a19d4f610d0cbe3e8ec3539bdd64c627ee0df66
Opcode Fuzzy Hash: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction Fuzzy Hash: 0ED19562B0C681F6EB2C9F2595482BA67B6FB45B86F048035DB9DC77A1CF38E4618701

Function 00007FF6C0435294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043551B

Part of subcall function 00007FF6C04413F4: CompareStringW.KERNEL32 ref: 00007FF6C044145A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction ID: 5cfa4dd7a211dccdce09e7d84d52babdd9e5ce1a9fbe251ea68f9826745a1e8e
Opcode Fuzzy Hash: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction Fuzzy Hash: 2A61F151A0C647E1FA689E25941427B6291AF59BD6F14E131EECDC7BD6EF6CE4808300

Function 00007FF6C0441870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C043E948: ReleaseSemaphore.KERNEL32 ref: 00007FF6C043E974
Part of subcall function 00007FF6C043E948: CloseHandle.KERNELBASE ref: 00007FF6C043E993
Part of subcall function 00007FF6C043E948: DeleteCriticalSection.KERNEL32 ref: 00007FF6C043E9AA
Part of subcall function 00007FF6C043E948: CloseHandle.KERNEL32 ref: 00007FF6C043E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0441ACB

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction ID: de8ccaf6c713178dd829d2d2fd6239bff6711729b95409954151664fc38426e4
Opcode Fuzzy Hash: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction Fuzzy Hash: CB617D72B16A85F2EE08DFA5D5540BE7365FB40F91F548532E7AD87B91CF28E4618300

Function 00007FF6C042EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042EEB8

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction ID: 7030f9c9d42e33f39649080abbcc0a082bdfce5564132eac97f227984729b2fa
Opcode Fuzzy Hash: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction Fuzzy Hash: B951A1A2B08682E0FA149F2694487AA2751FB85BC6F448136EFCDC7796CF3DE485C344

Function 00007FF6C042E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0433EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6C0440811), ref: 00007FF6C0433EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042E993

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: 34d078dacccde71bcb810d0530ddae62b6b05fb8392bf75a05bca4cfa6e2390e
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: 7A517F62B18686E1FA609F25D44977E2361FF84B86F448236EACDC77A5CF2CD481C750

Function 00007FF6C0431794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043187D

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction ID: 75481507368e2e2b69a972cc647c036a22f7fdf2d1886d998b104c089b13ad80
Opcode Fuzzy Hash: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction Fuzzy Hash: 1941D6A2B18A81D2EA149E17AA4437AA251FF48FC1F44D536EE9CC7F5ADF3CD5518300

Function 00007FF6C0432F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04330C8

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction ID: c5968b68a81ca0cae5b79438568a92846860a140f453f0fe8173f1002ec44cf3
Opcode Fuzzy Hash: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction Fuzzy Hash: 2141E262A0CB01D1EA149F29E14537B23B2EB89BDAF14A135EB8DC7799CF3CE4408700

Function 00007FF6C045BDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C045BE20

Part of subcall function 00007FF6C045BFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF6C045BFD0
Part of subcall function 00007FF6C045BFB0: GetProcAddress.KERNEL32 ref: 00007FF6C045BFE6
Part of subcall function 00007FF6C045BFB0: FreeLibrary.KERNEL32 ref: 00007FF6C045C00B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 767699b3de8fecc29643681a6fe87ea51e0935f058d3a4a218cfb66daf814877
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 7E418F36A18652E2FB249F15A8511BA33A1AF54B42F44C53ADA8DC77A1DF3DE841CB80

Function 00007FF6C042129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0421396

Part of subcall function 00007FF6C0421F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0421F89

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction ID: 57e8829788258e3e6adf3e97a1ca589e22e2b5da572cc6e9a352781a2582d3b2
Opcode Fuzzy Hash: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction Fuzzy Hash: 9F21AE22B08651E5EA149E92A50427B6251BB14FF1F688B30DFBEC7BE1DF7CE0518344

Function 00007FF6C046124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C0461280

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: ebdc4c15ad389aa6bcb76d5bfb3682a8211497fd113251732194f7ed66926894
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 3D115E32A1CA82E6F7209F50A49057B73A4FB40781F588575EACDD77A6EF2CE8408740

Function 00007FF6C0423AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0423B6C

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: 541c91011eaf36cc7e07166ea5b176133a661b847c4617cda0dce76b79102c73
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: A901C4A2F1C685D1EA159F28E44526E7362FB89792F409231EADCC7BA6DF2CE1408704

Function 00007FF6C0451558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C0451604: GetModuleHandleW.KERNEL32(?,?,?,00007FF6C0451573,?,?,?,00007FF6C045192A), ref: 00007FF6C045162B

DloadProtectSection.DELAYIMP ref: 00007FF6C04515C9

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: 200c2b81d7ff8623bb92642ed66f6518172798d37676039121a062fa42a781a9
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: 9611A8B4D09516F1FB619F05A84037223A0AF5474BF54893AC9CDC63B1EF3CA895C781

Function 00007FF6C0433EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C04340BC: FindFirstFileW.KERNELBASE ref: 00007FF6C043410B
Part of subcall function 00007FF6C04340BC: FindFirstFileW.KERNELBASE ref: 00007FF6C043415E
Part of subcall function 00007FF6C04340BC: GetLastError.KERNEL32 ref: 00007FF6C04341AF

FindClose.KERNELBASE(?,?,00000000,00007FF6C0440811), ref: 00007FF6C0433EFD

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 4d0ef3cf6c22f74e34ff05e3e51f20ad67e615c4247e2a664740f2cff73a6b0e
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 83F0A46290C241D5DA10AF75A1001BA37619B1DBB6F14A379EABDC73C7CF2CD4448744

Function 00007FF6C0421FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421FFB

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 23cadb91fec3bdd2c960eb1b128b5d9638ce6be25c9e1389157b11379c408e93
Instruction ID: 44c95058d293afe88e9b65ebd1f9c43ac0c143b4bf0110ff8b5ea96dafc48b77
Opcode Fuzzy Hash: 23cadb91fec3bdd2c960eb1b128b5d9638ce6be25c9e1389157b11379c408e93
Instruction Fuzzy Hash: AAF0BEA5B10689D0EE188F69D08836D2362EB04F89F508431D79CCBB65DF6CD480C300

Function 00007FF6C043273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6C0432755

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: db2a9098f1cec88669f6c0f20fe13f9c0c9b01f4821df036f9a7e188692e891f
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: 4AE08C22A24515D2EB20AF2AD84263A2320AF8CB86F48A030CE8DC7321CF28C4858B00

Function 00007FF6C0432490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6C04324A2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 1dfaea89a571cc8291169198082f09bfadc22f55591fefb05687f94119a331a4
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: D4D01222D09441E2DD109B359D5103E3350AFA6736FA45730D7BEC27E1CF1D949AA311

Function 00007FF6C0437FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6C0437FD2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 24f4ae1f408f5b0a1c3e1910ca162234289f7a13442020ae68d1f0027799109b
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: D6C08C20F05502C1DA085F26C8C901913A4BB44B06F61C038C58CC2260DF2CC5EE9345

Function 00007FF6C045FA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6C045FA59

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 4fdad17ea74ea54886c23418623bc655bbef40f70062fe82d615c19b969da8fd
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 93F06269F09617E5FE545F6195113B732905F84B42F0CD430C98DC63C1EF1CE9818312

Function 00007FF6C045D94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6C045D98A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: d4a85b0e44c1c6944ba367aab24433978b46702cc8a59f7786644449ef70d998
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: CDF0F8A9B0924BE5FF646FB158512B736905F847A2F08DA34D9EEC63C5EF2CA4818710

Function 00007FF6C04320D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6C043207E), ref: 00007FF6C04320F6

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: f2ee542fa4b4e975fcc951d0f3cba17dae2aaa22de43bd8736bba7b95964aee5
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 31F08132A18682E5FF248F20E24127A7660EB18B7AF499335D7BCC62D4DF28D8958700

Non-executed Functions

Function 00007FF6C042C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C042DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C042CF4B), ref: 00007FF6C042DE27
Part of subcall function 00007FF6C042DE04: GetLastError.KERNEL32 ref: 00007FF6C042DE88
Part of subcall function 00007FF6C042DE04: CloseHandle.KERNEL32 ref: 00007FF6C042DE9B

wcscpy.LIBCMT ref: 00007FF6C042CBC8
wcscpy.LIBCMT ref: 00007FF6C042CBFE
CreateFileW.KERNEL32 ref: 00007FF6C042CC38
DeviceIoControl.KERNEL32 ref: 00007FF6C042CD01
CloseHandle.KERNEL32 ref: 00007FF6C042CD12
GetLastError.KERNEL32 ref: 00007FF6C042CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF6C042CD7D
DeleteFileW.KERNEL32 ref: 00007FF6C042CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042CED7

Strings

UNC\, xrefs: 00007FF6C042C53F, 00007FF6C042C55D
SeRestorePrivilege, xrefs: 00007FF6C042C343
\??\, xrefs: 00007FF6C042C392, 00007FF6C042C3B8
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6C042C34F

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction ID: 75c52fe1649a7605a2508e7ae1257f6ee854f7fb63d385dec7ac8f3199706d09
Opcode Fuzzy Hash: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction Fuzzy Hash: 4A6290A2F18642E5FB00DF74D4492AE2361AF857A5F509232DAADD7BD6DF38E185C300

Function 00007FF6C043F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6C0440528

Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB67
Part of subcall function 00007FF6C043AAE0: LoadStringW.USER32 ref: 00007FF6C043AB80

Part of subcall function 00007FF6C044B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6C0440429), ref: 00007FF6C044B110
Part of subcall function 00007FF6C044B0DC: SetLastError.KERNEL32 ref: 00007FF6C044B153

Part of subcall function 00007FF6C042129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0421396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0440490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0440496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04404F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0440532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0440538

Strings

%ls, xrefs: 00007FF6C043F3AC, 00007FF6C043F3FF
%s: %s, xrefs: 00007FF6C043FC11

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction ID: b965a01e7c6b2699c32ab3553393d653444e78e05f89adb5a6bdb115e93de925
Opcode Fuzzy Hash: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction Fuzzy Hash: 47B28762A58682E1EA109F65E4541BB6311EFDA792F109336E7DDC3BE6EF2CD540C700

Function 00007FF6C0462550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C0462C12
memcpy_s.LIBCMT ref: 00007FF6C04635BF
memcpy_s.LIBCMT ref: 00007FF6C0463666

Part of subcall function 00007FF6C04638BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C04638EE

memcpy_s.LIBCMT ref: 00007FF6C046372F

Part of subcall function 00007FF6C045D008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045D02D

Strings

1#SNAN, xrefs: 00007FF6C04637C9
1#INF, xrefs: 00007FF6C0463807
1#QNAN, xrefs: 00007FF6C04637E8
1#IND, xrefs: 00007FF6C04637AA

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 23e6046bc3f6861cd29529368992e51290eac6fff634aca26d8ce9b5e6273dda
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: B5B2D672A08682EBE7258F65D5407FE37A1FB8478AF509135DB4AD7B84EF38E5048B00

Function 00007FF6C0431A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6C0431A97
GetLongPathNameW.KERNEL32 ref: 00007FF6C0431AE0
GetShortPathNameW.KERNEL32 ref: 00007FF6C0431B21
GetShortPathNameW.KERNEL32 ref: 00007FF6C0431B6A

Part of subcall function 00007FF6C04413C4: CompareStringW.KERNEL32 ref: 00007FF6C04413E3

MoveFileW.KERNEL32 ref: 00007FF6C0431DFE
MoveFileW.KERNEL32 ref: 00007FF6C0431E65

Part of subcall function 00007FF6C0432134: CreateFileW.KERNEL32 ref: 00007FF6C043223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0431FED

Strings

rtmp, xrefs: 00007FF6C0431CF4, 00007FF6C0431D03

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction ID: 7433332cf59b37aca643f1dd8ca977d756add89591ce8f09ccd3f5c1b33cba27
Opcode Fuzzy Hash: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction Fuzzy Hash: 4FF1E162B08A42E1EB10CF65D4841BF6761EB99BC5F50A136EA8DC3BA9DF3CD584C740

Function 00007FF6C0435B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6C0435BC2
GetFullPathNameW.KERNEL32 ref: 00007FF6C0435C0E
GetFullPathNameW.KERNEL32 ref: 00007FF6C0435D2B
GetFullPathNameW.KERNEL32 ref: 00007FF6C0435D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0435EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0435EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0435EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0435EF2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: ce99496107d3ae05995867c1cac3ee6ef1c2b5bcfe767034ebab825000d9e26c
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: 53A19F62F14B52D4FE008F7998451BE2361AB89BA9F14A235DEADD7BC9DF3CE1418300

Function 00007FF6C0453170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C045318C
RtlCaptureContext.KERNEL32 ref: 00007FF6C04531B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C04531D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C0453214
IsDebuggerPresent.KERNEL32 ref: 00007FF6C0453268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0453289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0453294

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: ec088331962331e33584337e2f8af1a0d9c1229ce0d9e07f7aa8d5be8e8ec297
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: AF313E76608B81DAEB608F60E8503EA7371FB84B45F448439DA8DC7B98EF38D548C710

Function 00007FF6C04576D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C0457751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C0457769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C04577A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6C04577DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C04577E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C04577F2

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: b8d2b1850d1694fbe8a6b644a5c6b1bc96fc2b440d523381479d192189722e62
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: C9314F36608B81D6EB60CF25E8402AE73A4FB88B55F544135EE9DC3B59EF38D555CB00

Function 00007FF6C0421AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0421EBB

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction ID: ef2fa6ac8a46e43b027351fc4ab10762e1025d6acde7f29393d38eb3ec10e64a
Opcode Fuzzy Hash: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction Fuzzy Hash: DEB1D662B14686E5EB109F65D8482EF2361FF99B85F409231EA9DC7BA9DF3CD540C300

Function 00007FF6C045FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045FAC4

Part of subcall function 00007FF6C0457934: GetCurrentProcess.KERNEL32(00007FF6C0460CCD), ref: 00007FF6C0457961

Strings

*?, xrefs: 00007FF6C045FAEB
., xrefs: 00007FF6C045FEE4

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: c5012e67b6624b875aee270761e7304093fe9e84a6c208f60423bb738eb43b84
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: B251E276B15AA9D1EF11DFA194100BA73A0FB48BD9B448531DE9DC7B89DF3CE0428301

Function 00007FF6C0462080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6C046210B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 98a3f1c954533774d208836a32b12120ac7882ab7b62fa70467cde99f4a4ce53
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: ADD18232B18686E7DB74CF15A2846AAB791F798785F148134DB8AD7B44EF3CE8418B00

Function 00007FF6C042B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6C042BA9D), ref: 00007FF6C042B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6C042BA9D), ref: 00007FF6C042B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6C042BA9D), ref: 00007FF6C042B743

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: 87ca32ef5e6d52f0e078c1553e5fd7e867c59859936557d2dfa767d36cc8bd69
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 3E01E87570C742D2E6109F62B89417BA3A5BBC9BC6F488138EACEC6B49DF3CD5058B40

Function 00007FF6C045FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6C045FEE4

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: a29e4d53a7ca7b4d333cfbbbd85e62be40bd969d3e56d9aacc06e0dcfee6353d
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: A1312836B086A595FB209F36A8057AB7A91AB94BE5F04C234EE9DC7BD5CF3CD5018300

Function 00007FF6C0465AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6C0465D45
RaiseException.KERNEL32 ref: 00007FF6C0465D56

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: ec86e200b0730fa3c51df48d330e057310b1170f97c472a29215b36e1ce5c9a3
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: C5B13873604B89CAEB19CF29C8463697BA0F744B49F19C922DA9DC77A8DF39D451C700

Function 00007FF6C0448DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C04485E0: GetDC.USER32 ref: 00007FF6C04485EC
Part of subcall function 00007FF6C04485E0: GetDeviceCaps.GDI32 ref: 00007FF6C04485FD
Part of subcall function 00007FF6C04485E0: ReleaseDC.USER32 ref: 00007FF6C044860A

GetObjectW.GDI32 ref: 00007FF6C0448E48

Part of subcall function 00007FF6C04490B0: GetDC.USER32 ref: 00007FF6C04490D9
Part of subcall function 00007FF6C04490B0: GetObjectW.GDI32 ref: 00007FF6C0449107
Part of subcall function 00007FF6C04490B0: ReleaseDC.USER32 ref: 00007FF6C04491BB

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 2e3a1b3009de92d0d68d75c79b0bcab4ab9f550ffb4da81dbc4c37d4fa013da1
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: DB812B36B08A05E6EB10CFAAD4406AE3771FB88B89F108526DE8DD7724DF38D545C780

Function 00007FF6C044A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6C044A315
GetNumberFormatW.KERNEL32 ref: 00007FF6C044A371

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: bb8303411e9a64dd5a8a8e6e78f5de27133c2e41d1f35447e0360c784fb43227
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 32110822A18B81E5E6618F61E4507AA7360FF88B85F848135DA8DC3754EF3CD149CB44

Function 00007FF6C043126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C04324C0: CreateFileW.KERNELBASE ref: 00007FF6C043259B
Part of subcall function 00007FF6C04324C0: GetLastError.KERNEL32 ref: 00007FF6C04325AE
Part of subcall function 00007FF6C04324C0: CreateFileW.KERNEL32 ref: 00007FF6C043260E
Part of subcall function 00007FF6C04324C0: GetLastError.KERNEL32 ref: 00007FF6C0432617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04315D0

Part of subcall function 00007FF6C0433980: MoveFileW.KERNEL32 ref: 00007FF6C04339BD
Part of subcall function 00007FF6C0433980: MoveFileW.KERNEL32 ref: 00007FF6C0433A34

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction ID: 7c599c52cf33db7344270ee12e7648d4958f29e42d7b81b4a43a59c3a791c628
Opcode Fuzzy Hash: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction Fuzzy Hash: 8591AE62B18A46E2EA10DF66D4442AF6361FB98FC5F40A032EE8DC7BA5DF38D545C740

Function 00007FF6C04351A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6C04351D5

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: 1650c1e40ccdb96f5c78b1e94e03069644a84634af00d1178a3fff85baeffcf1
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: 890113B2A18642EAE6648F14E84077B33A1BB98316F508235DAADC3790DF3CE5048F40

Function 00007FF6C0458C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6C0458DD3

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: b29a9818acf5aace1b4b8a571f86877cfbcced8982a58bdcd4213fa418cdfef9
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 9281F23AA18242E6FAA88E25804067F32F0EF51746F549539DDC9E7BD5CF2DE84AC740

Function 00007FF6C04589A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6C0458B3A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: ec844901045d0e143a7da7d0ce7c30561a709dda8d0d4c79841e79ec790ebc8b
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: DF71B179A0C282E6FAA88E29904027F37909F41746F18D53ADDC9E7796CF2DFC468741

Function 00007FF6C043C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF6C043C97B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: f8542b03e0ebfd5fd6c749b53c8ce978c34035106712f5852621804369d906b8
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: EC5190377286909BD724CF25E404A9EB3A5F388758F459126EF8A93B09CB3DE945CF40

Function 00007FF6C045C838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6C045C874

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 07f7dc01aa22673875055e6eabd14bc0a7497eb1d33c8ec255cbd2e8289f47a8
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: C441BD72714A54CAEE04CF2AE4582AA73A5AB58FD0B499136DE4DC7754EF3CD086C340

Function 00007FF6C0460D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6C0460D24

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 7f8761ce31e6617169777c7ed894ac20ecb88fc5206dd5c099b1d25f830f3335
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 91B09230E27A42E2EA082F516C8225523E4BF48B02F98C139C58CC1320EF2D24E54700

Function 00007FF6C0443964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction ID: 7f43365ed46534438e89d02ca3332a16b5a20f6edd77c8616aa33cb9a544d366
Opcode Fuzzy Hash: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction Fuzzy Hash: 7A82E1A2A096C1A6D705CFA8D4442BD7BA2E795F8AF19C13ADA8EC7385DF3CD445C310

Function 00007FF6C04276C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 25a68ea5cc7bd3a6419982070de3de8fcb57ead0cecefd5df7031043095ad47a
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 61627E9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF6C04453F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction ID: 548e631c27a1ff3f03fac2ae0e16191a331b3adb64ccf780eef03761d10d1afe
Opcode Fuzzy Hash: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction Fuzzy Hash: 3E82FFB2A096C1AADB24CF68D4446FD7BA1E755B49F18C136CA8DC778ACF389885C710

Function 00007FF6C043BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: b58ad9a8f254d3f077cc305f185f0c619baa68e87ce5d5d0e0f4434f80cf5425
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 7122F373B206508BD728CF25C89AE5E3766F798344B4B8228DF4ACB789DB38D505CB40

Function 00007FF6C0444B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 36172a2deffece0a333a766aae85de77117dbca4b9dcb193a6da567c8729e5ab
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 2F32CFB2A04591ABE718CF24D550ABE37A1F794B49F05C139DA8AC7B89DF3CE864C740

Function 00007FF6C0427288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 539415a41750f1927ca9c43d162af5be930a361bac67573335b89680616524a8
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 1FC19DB7B281908FE350CF7AD400A9D3BB1F39878CB519125EF59A7B09D639E645CB40

Function 00007FF6C0442D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: c1201e75a404fa1e2fb7da0ef738f64162b8d29c139a6d3d5b846cb3e96516f2
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 6EA10272A08182F6EB15CE64D5047FB6692EBA4B46F95C635DACAC7786CF3CE841C300

Function 00007FF6C043AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 55e0c4811543f8b1ec3906ec4bde1d4adbf44ac1bc69a5b5824d86729b51bf17
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: 10C1F677A291E08DE302CBB5A4248FD3FB1E71E34DB4A4151EFD697B4AD6285201DF60

Function 00007FF6C042A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 85a94764dc1c11620cbb6abdb96d19e928486cd38bfb8493620a3968d2344bab
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 27912F62B18581A6EB11CF29D4552EE6721FF99789F445031EF8EC7B49EF38E646C300

Function 00007FF6C043B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: e42ea1ada08c45b9af4eb6f0ff495a7cbcd21b8b415e90b4fd0caa3122ec8469
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: F761FF22B181D1A9EB118F7585005FE7BA1E759789B468032CFDAD7746CF2CE506CB90

Function 00007FF6C04421D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 57ce7081973123b1b416341fb658eae8d7d672ce7c5ef2dc770834248e8ad6b3
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: FF51F173A18151ABE7298F6892047AE7762F790B49F848134DB89C7788DF3DE541CB00

Function 00007FF6C0442AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 6c170cfd244ea48869c7c7f1e2bab38dc6c88f7260d1a7fa33787a5e4eba9d85
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 5331D2A2A08581ABD708CE5A96502BF7791F784385F44D139DF8AC3B81DF3CE441CB00

Function 00007FF6C04658E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: 933276cf61b7cc95ad7a93ae5760af6b8973e5dbea70963b44a6675263fe218d
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: ABF062B2B28695DBDBA48F2DA84262A77D0F708381F84C53AD6CDC3B04DB3C94609F44

Function 00007FF6C0453354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 0906b286ed95a9c60fb466a7ddb54dffa4036513d5244c53de8855b0505664ed
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 2DA0027590CC46F0E6448F10E9600763331FBA0703B508175F88DC13A4EF3DA541C300

Function 00007FF6C042D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D964

Strings

::$ATTRIBUTE_LIST, xrefs: 00007FF6C042D7FC
::$REPARSE_POINT, xrefs: 00007FF6C042D88B
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C042D875
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C042D86A
::$FILE_NAME, xrefs: 00007FF6C042D833
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6C042D849
::$INDEX_ROOT, xrefs: 00007FF6C042D854
::$EA_INFORMATION, xrefs: 00007FF6C042D828
::$OBJECT_ID, xrefs: 00007FF6C042D880
::$BITMAP, xrefs: 00007FF6C042D807
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C042D85F
::$EA, xrefs: 00007FF6C042D81D
::$INDEX_ALLOCATION, xrefs: 00007FF6C042D83E
::$DATA, xrefs: 00007FF6C042D812

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction ID: 56b39a7cfe72bcf9509942e66978de1208f54ac5e9631b2c9f0d8fe299de9d62
Opcode Fuzzy Hash: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction Fuzzy Hash: A941D776B05B01E9EB008F65E4443EA33B5EB48799F40823ADA9CD3B69EF38D155C394

Function 00007FF6C0452A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6C0452A26
GetModuleHandleW.KERNEL32 ref: 00007FF6C0452A33
GetModuleHandleW.KERNEL32 ref: 00007FF6C0452A48
GetProcAddress.KERNEL32 ref: 00007FF6C0452A60
GetProcAddress.KERNEL32 ref: 00007FF6C0452A73
CreateEventW.KERNEL32 ref: 00007FF6C0452A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF6C0452AEB
CloseHandle.KERNEL32 ref: 00007FF6C0452AFD

Strings

kernel32.dll, xrefs: 00007FF6C0452A41
SleepConditionVariableCS, xrefs: 00007FF6C0452A56
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6C0452A2C
WakeAllConditionVariable, xrefs: 00007FF6C0452A66

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: efb10c2514bccb9fea723a0b0956fceed59ed354e7254ed7f4ee1b4110928fe6
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 5A210C74E09A03F2EA559F50E95417A33A0AF55B82F44853AD9CEC27A0EF3CB4858340

Function 00007FF6C0436A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370A6

Part of subcall function 00007FF6C0422004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6C042200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04370DC

Strings

\\?\, xrefs: 00007FF6C0436A57, 00007FF6C0436A66
DXGIDebug.dll, xrefs: 00007FF6C0436A18
UNC, xrefs: 00007FF6C0436BBF

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: caeda946b173b290eeb0eea351584ffd7bcd35d17f0c3fb79cdbd079912c01be
Instruction ID: 1734dbf7e0890ffd70ae1f10fffc69618c0b3cea3716f8a8634a8428b6bc7942
Opcode Fuzzy Hash: caeda946b173b290eeb0eea351584ffd7bcd35d17f0c3fb79cdbd079912c01be
Instruction Fuzzy Hash: 8312BC62B08A42E0EA10DF64E0441AE6375EB89B99F509236DBDDC7BE9DF3CD549C340

Function 00007FF6C044A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C042129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0421396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044A747
EndDialog.USER32 ref: 00007FF6C044A7BA

Strings

GETPASSWORD1, xrefs: 00007FF6C044A773
Software\WinRAR SFX, xrefs: 00007FF6C044A52B, 00007FF6C044A53A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: c2ad28c9ce9f64f5bccf4f1773c8c688f61bbc68e6832096d5a3dbdb5c0c2145
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: 89B19DA2F19B42E5FB00DFA4D4442BE2362AB45799F408235DA9CE6BD9EF3CE155C340

Function 00007FF6C0446E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C0447E9B), ref: 00007FF6C0447080
CreateStreamOnHGlobal.COMBASE ref: 00007FF6C04470B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0447181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0447187

Strings

<html>, xrefs: 00007FF6C0446F13
</html>, xrefs: 00007FF6C0446F72, 00007FF6C0446F81
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6C0446F2C, 00007FF6C0446F3B
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6C0446ED5, 00007FF6C0446EE4

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction ID: d3178e1bcd4eb85be8cebd16dac164465f9110b0c7dd7a04ee40bf3623504885
Opcode Fuzzy Hash: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction Fuzzy Hash: 2A817C62B18A42E5FB00DFA5D4401EE3375AB4978AF408136DE9DD779AEF78D50AC340

Function 00007FF6C045E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045E7CD

Strings

NAN(IND), xrefs: 00007FF6C045E6FB
nan(snan), xrefs: 00007FF6C045E6F0
inf, xrefs: 00007FF6C045E6D6
INF, xrefs: 00007FF6C045E6C3
NAN, xrefs: 00007FF6C045E6B1
nan, xrefs: 00007FF6C045E6B8
NAN(SNAN), xrefs: 00007FF6C045E6E5
nan(ind), xrefs: 00007FF6C045E706

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 235c390b7589497ec955317d4dc4ee8d3937a79444783415c50d3901ac4894d2
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 92418D76A09B45E9EB04CF25E8517AA33A4EB18398F418136EE9CC7B54EF3CD029C344

Function 00007FF6C044F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6C044F3CF
GetClassNameW.USER32 ref: 00007FF6C044F3FC
GetWindowLongPtrW.USER32 ref: 00007FF6C044F41D
SendMessageW.USER32 ref: 00007FF6C044F437
GetObjectW.GDI32 ref: 00007FF6C044F452
SendMessageW.USER32 ref: 00007FF6C044F487
DeleteObject.GDI32 ref: 00007FF6C044F490
GetWindow.USER32 ref: 00007FF6C044F49E

Strings

STATIC, xrefs: 00007FF6C044F402

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 6827c6016d983938dd863bef20a3f5c5160554d913610de0c8e80cc802c4ca0f
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 6D31D221B08652E2FA61DF62A514BBB2391BF99BD2F008431DD8DC7B56DF3CE4028780

Function 00007FF6C044AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6C044AEAE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 4048283fd304c7dd7ca362f36117473ebdb6932becc7ac3c0982de492554705e
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: 5F418E21A08A52E2FB508F56A85477B22A0AF84B86F14C535DD8EC7B95CF3CE9468740

Function 00007FF6C043B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6C043BA12
GetProcAddress.KERNEL32 ref: 00007FF6C043BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF6C043BACA

Part of subcall function 00007FF6C043DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C043DDDF

Strings

CryptUnprotectMemory failed, xrefs: 00007FF6C043BAC1
CryptProtectMemory, xrefs: 00007FF6C043BA08
CryptProtectMemory failed, xrefs: 00007FF6C043BA80
CryptUnprotectMemory, xrefs: 00007FF6C043BA1F
Crypt32.dll, xrefs: 00007FF6C043B9F0

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: e67dc9d8b8a0099347aa530b4cd96832167297a51efe9fac813d6c9adefa1a35
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 9F317020A0DB03E1FA149F15A96427727A1AF49B96F14D636CADEC37A4EF3CF5418780

Function 00007FF6C04487D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0448DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0448DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0448DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0448DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0448DE0

Strings

, xrefs: 00007FF6C04488BE
, xrefs: 00007FF6C0448A55

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction ID: 8e32d1aa57c3899998256de032aa8a8b7c43327accec4c2641d5a629be7154db
Opcode Fuzzy Hash: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction Fuzzy Hash: 9FF1C1A2F15B46F0EE109FA4D4881BE2361AB54B9AF509239DAADD37D5DF7CE180C340

Function 00007FF6C04557EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6C045598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0455CAD
abort.LIBCMT ref: 00007FF6C0455CE1

Strings

csm, xrefs: 00007FF6C04559B1
csm, xrefs: 00007FF6C04558D1
csm, xrefs: 00007FF6C0455933

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 05de6aa7fd0414abafcf993a5b20baf6d5f84f7e3563c49073f5e2d5662e33f2
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 06E19D7AA08782DAE7219FA4D4903BE77A0FB45759F148135EA8DC7796CF38E485CB00

Function 00007FF6C0434F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0434E24: SysAllocString.OLEAUT32 ref: 00007FF6C0434E5F

VariantClear.OLEAUT32 ref: 00007FF6C0435125

Strings

Name, xrefs: 00007FF6C04350F9
Windows 10, xrefs: 00007FF6C043510A
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6C0435017
WQL, xrefs: 00007FF6C043502A
ROOT\CIMV2, xrefs: 00007FF6C0434F7B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 35cb04e9f8450a1954fe1f903298a0b13448ce3b59843950196f849c77dc2b1a
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: D6712B76A14A05E5EB10CF25D8805AE77B0FB88B99F049236DA8EC3B64DF38D544C740

Function 00007FF6C04572EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C04574F3,?,?,?,00007FF6C045525E,?,?,?,00007FF6C0455219), ref: 00007FF6C0457371
GetLastError.KERNEL32(?,?,00000000,00007FF6C04574F3,?,?,?,00007FF6C045525E,?,?,?,00007FF6C0455219), ref: 00007FF6C045737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C04574F3,?,?,?,00007FF6C045525E,?,?,?,00007FF6C0455219), ref: 00007FF6C04573A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6C04574F3,?,?,?,00007FF6C045525E,?,?,?,00007FF6C0455219), ref: 00007FF6C04573EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6C04574F3,?,?,?,00007FF6C045525E,?,?,?,00007FF6C0455219), ref: 00007FF6C04573FB

Strings

api-ms-, xrefs: 00007FF6C0457391

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: a38d1bd0314a6f2b99417d86184981514dfc9d48394d514539f088633d732dfc
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 31318D35A1AA42E1EA11DF06B80067633A4FF49BB6F198635DD9DCA390EF3CE145C710

Function 00007FF6C0451604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6C0451573,?,?,?,00007FF6C045192A), ref: 00007FF6C045162B
GetProcAddress.KERNEL32(?,?,?,00007FF6C0451573,?,?,?,00007FF6C045192A), ref: 00007FF6C0451648
GetProcAddress.KERNEL32(?,?,?,00007FF6C0451573,?,?,?,00007FF6C045192A), ref: 00007FF6C0451664

Strings

KERNEL32.DLL, xrefs: 00007FF6C0451624
AcquireSRWLockExclusive, xrefs: 00007FF6C045163E
ReleaseSRWLockExclusive, xrefs: 00007FF6C0451653

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 1110e65ee980caea7a55e94d8d40d3b22db60106f036dac97ffe94903ff190a6
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: AA110935A1AB02F3FE658F00A94027723A56F09B96F4CD539C8DDC67A0EF3CA4858740

Function 00007FF6C043ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C04351A4: GetVersionExW.KERNEL32 ref: 00007FF6C04351D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0425AB4), ref: 00007FF6C043EE05

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 4ce8f460c4db59f6a713e2b6c20c02386099f9a158b2c8a700eea7ff379f7aac
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: B2517AB2B00651DAEB04CFA9D4505AD37B1F748B89B60903ADE4DE7B58EF38E556CB00

Function 00007FF6C043F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6C043F074

Part of subcall function 00007FF6C04351A4: GetVersionExW.KERNEL32 ref: 00007FF6C04351D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6C043F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF6C043F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6C043F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C043F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C043F0CE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 80d402b44ade8c67cc443f9fb7fc00e734509d6f88cc19bad4d59e4df696e04c
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 7C312762B10A51DAEB04CFB5E8901AD3770FB08759B54902AEE4ED7B58EF38D895C700

Function 00007FF6C0437918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0437C8C

Strings

rar, xrefs: 00007FF6C0437A9B, 00007FF6C0437AAA, 00007FF6C0437B67, 00007FF6C0437B7C
.rar, xrefs: 00007FF6C0437969, 00007FF6C0437978
sfx, xrefs: 00007FF6C04379F3, 00007FF6C0437A02
exe, xrefs: 00007FF6C04379AF, 00007FF6C04379BE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction ID: cf5e83eddae19e4ecf53308b19405fe05905c62c6bcdd1f9cf9545a245d7801a
Opcode Fuzzy Hash: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction Fuzzy Hash: 26A1D322A04A06E0EB149F25D8452BE2361BF59BA9F50A235DEDDC77E6DF3CE641C340

Function 00007FF6C0455CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6C0455D58

Part of subcall function 00007FF6C0455210: abort.LIBCMT ref: 00007FF6C0455223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6C0455DA3
abort.LIBCMT ref: 00007FF6C0455FD1

Strings

MOC, xrefs: 00007FF6C0455D6C
RCC, xrefs: 00007FF6C0455D74

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 34a9492667bc6764048c6893aa756df3807b91c6219567a984a55e6da593560c
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 3291B077A08B81EAE710CFA4E4502AE7BA0F744789F10813AEE8D97B55DF38D195CB00

Function 00007FF6C0454F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C0454FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6C0455040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6C0452F5E), ref: 00007FF6C045508F

Strings

csm, xrefs: 00007FF6C0455026
f, xrefs: 00007FF6C0454FBE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: f73b09c86a9e3e0cc04b0f6d920cb7af21d9fecc90ec73cda9017eb435785217
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: A851B13AE19A02E6EB14CF55E454B3A37A5FB40B89F50C034DA9AC7788DF78E941C740

Function 00007FF6C042CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C042D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D0D7

Part of subcall function 00007FF6C042DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C042CF4B), ref: 00007FF6C042DE27
Part of subcall function 00007FF6C042DE04: GetLastError.KERNEL32 ref: 00007FF6C042DE88
Part of subcall function 00007FF6C042DE04: CloseHandle.KERNEL32 ref: 00007FF6C042DE9B

Strings

SeRestorePrivilege, xrefs: 00007FF6C042CF5E
SeSecurityPrivilege, xrefs: 00007FF6C042CF3F

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction ID: a5b625f49b9356486004f5fba27183055a08d29e558bc6cfbd145423cc83594a
Opcode Fuzzy Hash: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction Fuzzy Hash: DD51C2A2F18642E5FB00DF65D8442BE2361AF857AAF008635DE9DD77A6DF3CA485C340

Function 00007FF6C0447B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6C0447B6F
GetWindowRect.USER32 ref: 00007FF6C0447BC0
ShowWindow.USER32 ref: 00007FF6C0447C96
ShowWindow.USER32 ref: 00007FF6C0447CC3

Strings

RarHtmlClassName, xrefs: 00007FF6C0447C4B

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: b55208c842f3ba5f8ad15ca2cc56a18e49548ac1c39c61e439b34db84a874ccd
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: 50518026A08B82E6EA249F66E44477B63A0FB85B81F008535DECEC7B55DF3CE4458B40

Function 00007FF6C044FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C044FD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C044FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C044FE1B

Strings

sfxpar, xrefs: 00007FF6C044FDB5
sfxcmd, xrefs: 00007FF6C044FD3C

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 61e0756cadd6b653d1582375615aa426a1fb3b0aec850631be044289d9499a5b
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: F5319EB2E14A16E4EB008FA5E4841AE3371EB48B99F148131DE9ED77A8DF38E051C344

Function 00007FF6C044FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF6C044FF60
REPLACEFILEDLG, xrefs: 00007FF6C044FF34, 00007FF6C044FF99

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: 02ddb65545b7caa66a75f75e7e6b936630b5a35d877b5c4df86b9218be8037ee
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: D0210321A18B47F2FA118F99A84417627A0AF49B8AF54C937D9CDC7360DF3CE598C380

Function 00007FF6C045BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6C045BFD0
GetProcAddress.KERNEL32 ref: 00007FF6C045BFE6
FreeLibrary.KERNEL32 ref: 00007FF6C045C00B

Strings

CorExitProcess, xrefs: 00007FF6C045BFDF
mscoree.dll, xrefs: 00007FF6C045BFC7

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: abaeaf6cf380929163e89f9c700a8cb95f31595f4bd802b26747d5e2a97ae693
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: E1F06235A19A42E1EF448F51F85027A6360EF88B96F44903AD9CFC6764EF3CE485C700

Function 00007FF6C04645C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C0464605

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 97aaa4207f9727f9a326253abaff60997dc1787441b20748d4c79f0b770bf2be
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 3F81BF36F18652E9FB209F65D8406BE26A0BB85B8AF00C135DD8ED3B95EF3CA445C710

Function 00007FF6C0433AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6C0433BBB
CreateFileW.KERNEL32 ref: 00007FF6C0433C24
SetFileTime.KERNEL32 ref: 00007FF6C0433CEC
CloseHandle.KERNEL32 ref: 00007FF6C0433CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0433D2C

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction ID: caf2a591a90798d3145d1cc11822ff1daec299799e7cabf537fef75d53730784
Opcode Fuzzy Hash: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction Fuzzy Hash: 4051A362B08A42E9FB50CF65E4403BE63B2AB487AAF04A635DE9DD77D5DF3C94458300

Function 00007FF6C0463F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6C0464767), ref: 00007FF6C0463F91
WideCharToMultiByte.KERNEL32 ref: 00007FF6C046406D
WriteFile.KERNEL32 ref: 00007FF6C0464093
WriteFile.KERNEL32 ref: 00007FF6C04640D2
GetLastError.KERNEL32 ref: 00007FF6C046410A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 8b9b5f1b1bd38365a5832425382f34137a6d3015c5c4b75327ad16e002037e58
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 7D519E32A18A51D9EB10CF65D4443AE3BB1BB89B99F048135DE8AD7B99EF38D185C700

Function 00007FF6C0451E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C0434DF4), ref: 00007FF6C0451E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C0434DF4), ref: 00007FF6C0451F09
SysAllocString.OLEAUT32 ref: 00007FF6C0451F16

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction ID: 256f87a1a06a9c8a30e3dc82cb805a64d033042921ab0de4cd90187e5f55469e
Opcode Fuzzy Hash: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction Fuzzy Hash: 9241A336A09646E9EB149F21945137A32A1EF08FA6F148634EAADC77E5DF3CE1418300

Function 00007FF6C045F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6C045F536

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: dc87be887967c3f824f192c565052c00c2250e13597178911495863417b87244
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 2841CF35B09A56F1FA158F16A8046B77295BB14B91F098535DD9DCB744EF3CE0408341

Function 00007FF6C04656D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6C04656FF
_set_statfp.LIBCMT ref: 00007FF6C046571A
_set_statfp.LIBCMT ref: 00007FF6C0465736
_set_statfp.LIBCMT ref: 00007FF6C0465772

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: db01dda2bd845f41f11ae69b619b77be779ca4c68acddfc53592da31d33a848b
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 9E116D76F18A07E1FA541B24E54237B11516F553A3E48C234EAFECA7D6BF2CA8404305

Function 00007FF6C044FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6C044FE41
GetMessageW.USER32 ref: 00007FF6C044FE58
TranslateMessage.USER32 ref: 00007FF6C044FE63
DispatchMessageW.USER32 ref: 00007FF6C044FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF6C044FE7C

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 772cbc6df335732441e48994620ee6d47003a48d5f341dd5a9cbc3814c2dc4bc
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 85F04F21B28456E2F7108F61E458E772261FFA4B06F549531E58EC5AA49F3CD149C700

Function 00007FF6C045625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C0456286
abort.LIBCMT ref: 00007FF6C04564EA

Strings

csm, xrefs: 00007FF6C04562AB
csm, xrefs: 00007FF6C045641A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 732ba165c9fb3313c9fbafc8418b0da3180eb952a3ee3f1750f30b2279645e9f
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 8C71907A608691E6D7608F25905077EBBA4EB05B8AF14C135EE8CC7B85CF3CD491C745

Function 00007FF6C04580F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C04582ED

Strings

, xrefs: 00007FF6C0458276
*, xrefs: 00007FF6C0458221

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: b99ad8b46f137a31b1db5432fc6fc0beaee84970363a85b69b6f54932dc3ddb5
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 0C51557A90CA42EAE7648F28844537E3FA1FB05B1AF14917DD6CAE1399CF78D481C705

Function 00007FF6C0461758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6C04617CB
MultiByteToWideChar.KERNEL32 ref: 00007FF6C0461894
GetStringTypeW.KERNEL32 ref: 00007FF6C04618AE

Strings

$%s, xrefs: 00007FF6C046175A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 19a832e35c9eb62fb33b4f70631c088635659b485fc20dcbb4c23ac5d292560c
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 4E41A532B14B81EAEB219F25D8006AA2391FB44BA9F488635DE9DC77D4EF3CE4418340

Function 00007FF6C04566A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0455210: abort.LIBCMT ref: 00007FF6C0455223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C045674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6C0456776

Strings

csm, xrefs: 00007FF6C0456876

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 56a7e87625f145da6b39d5a2b0faff6c85334ecc506cf6d5b74b7e08973d03c1
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 7A516A7A619742D7EA60AF66E04026F77A4FB88BA1F044134EBCD87B55CF38E460CB01

Function 00007FF6C0464360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6C0464446
WriteFile.KERNEL32 ref: 00007FF6C0464479
GetLastError.KERNEL32 ref: 00007FF6C046449B

Strings

U, xrefs: 00007FF6C0464424

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 7b2f7eff70d6f4b1b45052ab48732d9a37bd63228d976ff020b1ed7bf3681d9d
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 4A41AE22B18A81D2EB208F65E8453BA77A0FB88795F448135EE8DC7788EF7CD445C740

Function 00007FF6C04490B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C04490D9
GetObjectW.GDI32 ref: 00007FF6C0449107
ReleaseDC.USER32 ref: 00007FF6C04491BB

Strings

, xrefs: 00007FF6C0449153

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 3bb25b5f1b72fc6c1d59f5efa1b57260a567c2552e5fdbb45de2876a0a7ab3f1
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 64313E3560975296DA049F13B818A2B7760F78AFD2F508936ED8AC7754CF3CD449CB40

Function 00007FF6C043E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6C044317F,?,?,00001000,00007FF6C042E51D), ref: 00007FF6C043E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6C044317F,?,?,00001000,00007FF6C042E51D), ref: 00007FF6C043E8CB
CreateEventW.KERNEL32(?,?,?,00007FF6C044317F,?,?,00001000,00007FF6C042E51D), ref: 00007FF6C043E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF6C043E900

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 238375313c292344cdb7dcc5faea280ce2ff4e3e97a18e2313cc7228df4c1546
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 7321C372E16642D6F7508F25D4447AA32A2EB88B0EF18C134CA8DCB395DF7E98458780

Function 00007FF6C04485E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C04485EC
GetDeviceCaps.GDI32 ref: 00007FF6C04485FD
ReleaseDC.USER32 ref: 00007FF6C044860A

Strings

, xrefs: 00007FF6C0448610

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: c30d4a1343d0bad293d22a3405de1f3a3a21cbdae7e125cc8123b9a20b58f358
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 91E08C20B08642D2EB086BB6B58982B2261AB4CBD1F158936DA5ACB794CE3CC4844300

Function 00007FF6C042D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6C042D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042D560

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction ID: 837ae6b5962723ae68ad7326373200f6927c3672f82d061f48a56e65c8684ea1
Opcode Fuzzy Hash: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction Fuzzy Hash: 73A18062B18A82E1EA10DF65E4481AF6361FB85785F409531EADDC3BA9DF3CE544C700

Function 00007FF6C0440548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C04405FC
SetLastError.KERNEL32 ref: 00007FF6C0440697

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction ID: 752abdfd1528ca7122db106eb3b514d7d8b04f58cc69e491d707cdde633066b9
Opcode Fuzzy Hash: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction Fuzzy Hash: A2519172B14A46E5FB009F64D4442EE2321EB89B9AF408236DA9CD7B96EF3CD254C340

Function 00007FF6C0449D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6C0449DBC
GetLastError.KERNEL32 ref: 00007FF6C0449E08
CreateDirectoryW.KERNEL32 ref: 00007FF6C0449F10
LocalFree.KERNEL32 ref: 00007FF6C0449F20

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction ID: 78b8d7e1bb34a95dd53ea224be031949d1aa361e2515792973e7dc8d6e69372d
Opcode Fuzzy Hash: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction Fuzzy Hash: D7517E32A18B42E6E7408F61E4447AE73A4FB85B85F508536EA8DD7B54DF3DD808CB40

Function 00007FF6C045DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045DBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF6C045DC81
GetLastError.KERNEL32 ref: 00007FF6C045DCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045DCD6

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 064e361d132905d704df196d5f9fb602ae70231e481d4974a31e0f505dc647c4
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: F941603AA08642E6FF769F14914437B72A1AF90B92F15C131DADDC6B99DF6CE881C700

Function 00007FF6C0433980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6C04339BD
MoveFileW.KERNEL32 ref: 00007FF6C0433A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0433AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0433AF1

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction ID: 49e703db6bdbcd2de040afb8f1a925f8ec1e0bd4ae690d120e2e57a7363bb1a4
Opcode Fuzzy Hash: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction Fuzzy Hash: 5941AEA2F18651D4FB00DF65E8441AE2372BB49BA6F10A235EE9DE7B99DF78D045C300

Function 00007FF6C0460B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C045C45B), ref: 00007FF6C0460B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C045C45B), ref: 00007FF6C0460BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C045C45B), ref: 00007FF6C0460C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C045C45B), ref: 00007FF6C0460C57

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 519776f257dfaf0360f1fddd31df9272ab052298d94098107fc0eda448d3e78a
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: A0214471B18B51D1E6649F11A44002B77A4FB54FD2B488234DEDEE3B98EF3CE4528704

Function 00007FF6C045D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6C0457F28,?,?,?,00007FF6C0459D35), ref: 00007FF6C045D44A
SetLastError.KERNEL32(?,?,?,00007FF6C0457F28,?,?,?,00007FF6C0459D35), ref: 00007FF6C045D4B2
SetLastError.KERNEL32(?,?,?,00007FF6C0457F28,?,?,?,00007FF6C0459D35), ref: 00007FF6C045D4C8
abort.LIBCMT ref: 00007FF6C045D4CE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 57e8c2f49a435b7f6b424d7717800c813886ea7eb113f41e6f2da325029b1f7a
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 5B018038B08602E2FE68AF71655517A32A15F44792F04C538D9DEC27D6EF3CB8058300

Function 00007FF6C0448590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C0448598
GetDeviceCaps.GDI32 ref: 00007FF6C04485AE
GetDeviceCaps.GDI32 ref: 00007FF6C04485C2
ReleaseDC.USER32 ref: 00007FF6C04485D3

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 18fecea8e89abc2e9b64bab72d714b8ca1ddee47ea38730132c7532554b01430
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 88E0ED60E09602E2FF085FB268995372190AF49743F48CD3BC85ECA350DF3CE1858750

Function 00007FF6C042E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C042E549

Strings

DXGIDebug.dll, xrefs: 00007FF6C042E35A

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 0a6e8a5cf670b8866c9f9b50e0138bc92bc45c918b99fe1d1ba172bd3edf1b53
Instruction ID: 8bd590aeb4d75a7f52d939907673e5fc3f11b862de34e4758775cb650f81c6c5
Opcode Fuzzy Hash: 0a6e8a5cf670b8866c9f9b50e0138bc92bc45c918b99fe1d1ba172bd3edf1b53
Instruction Fuzzy Hash: 9771AD72A14B81E2EB14CF65E5443AEB3A4FB58B94F448236DBAC87BA5DF78D051C300

Function 00007FF6C045E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045E237

Strings

gfff, xrefs: 00007FF6C045E362
e+000, xrefs: 00007FF6C045E2DF

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: e52a66dcf71e0ebd0f2253d3aab5141b41db11d3f56addeabe8f07cb1f40167c
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 70510276B1C7C1A6E7298F36984076A7A91AB80B91F08C271DAD8C7BDACF2CD4448700

Function 00007FF6C0439408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C04395A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C04395E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C043959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C04395A2

Strings

SIZE, xrefs: 00007FF6C0439443

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: 600485e862f8e843bf8edeaefbb0264b077da6acfcfff2f194973c6234bf5c3a
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: 7C419F63A18642E5EA11DF14E4453BB6350AB99792F509231EADDC37D6EF3CD980C704

Function 00007FF6C045C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C045C2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6C0452CD5), ref: 00007FF6C045C30B

Strings

C:\Users\user\Desktop\0438.pdf.exe, xrefs: 00007FF6C045C2F9

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\0438.pdf.exe
API String ID: 3307058713-792344357
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 186374abe12d2cdcfeb59034300cecb964b575429bf7d826e1cd30bc0e86a6b6
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 0D414C7AA08A56EAEB149F25A8400BE77A4EF44B95F54C036ED8EC7B85DF3DE4418340

Function 00007FF6C0449B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C042255C: GetDlgItem.USER32 ref: 00007FF6C04225AC
Part of subcall function 00007FF6C042255C: SetWindowTextW.USER32 ref: 00007FF6C04225C8

EndDialog.USER32 ref: 00007FF6C0449C24
SetDlgItemTextW.USER32 ref: 00007FF6C0449CAA

Strings

ASKNEXTVOL, xrefs: 00007FF6C0449B72

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction ID: e1da7afdb0a4d162483765e83ad1a11cf3df4314e22b6e0268a4617639c61a6f
Opcode Fuzzy Hash: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction Fuzzy Hash: F9418421B08682F1FA509F52E5942BB23A1AF85BC2F148036DECDC7795DF3CE9419384

Function 00007FF6C0439638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C04396EA

Part of subcall function 00007FF6C0440F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6C0440F99

Strings

$%s, xrefs: 00007FF6C04396D7
@%s, xrefs: 00007FF6C04396CE

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 06b3665c4e4c3c1dbf58647a75264032923534cdf26bd741b5e5934cc14a13b1
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: AC31E372B19A46E5EA108F66E4402EB23A0FB497C5F40A032EE8DC7795EF3CE915C740

Function 00007FF6C045EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6C045EB76
GetFileType.KERNEL32 ref: 00007FF6C045EB8C

Strings

@, xrefs: 00007FF6C045EBB7

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 72a994f25d39ae97cd4f7aead8abe1ff810d34ec2ba076abde93f70cffa65df6
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 9021AD36E0CA82D1EB688F26949053A3651EB45776F288335D6AFC67D4DF38E881C300

Function 00007FF6C0454078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C0451D3E), ref: 00007FF6C04540BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C0451D3E), ref: 00007FF6C0454102

Strings

csm, xrefs: 00007FF6C04540EF

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 653cc94c5c0b29a88be4481fbd082de572d2c069269b1c48bdc473e3fb341ff8
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 31112B36608B4192EB608F15E44026A77A1FB88B99F288235DFCD87794DF3DD555C700

Function 00007FF6C043EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C043E95F,?,?,?,00007FF6C043463A,?,?,?), ref: 00007FF6C043EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C043E95F,?,?,?,00007FF6C043463A,?,?,?), ref: 00007FF6C043EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6C043EA78

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: edd27a856b0442219b3176d9c04eb60a12b4660f288511c5a36aeabf6c43ddc5
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 0BE09A60E29802E1F200AF209C464BB22207F60372F908331D0BEC13E1AF2CA9498341

Function 00007FF6C043A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C043A447
FindResourceW.KERNEL32 ref: 00007FF6C043A45D

Strings

RTL, xrefs: 00007FF6C043A453

Memory Dump Source

Source File: 00000000.00000002.1705889456.00007FF6C0421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C0420000, based on PE: true

Associated: 00000000.00000002.1705867956.00007FF6C0420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705944063.00007FF6C0468000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705985625.00007FF6C0484000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706036458.00007FF6C048E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c0420000_0438.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 77ec3af47597800b8737e3d7f8d21b7d4d2e17aef4ce716fde673998c23323d9
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 4AD01791F09602D2FF194F61A45937612605B19B42F48D038C88AC6391EF6C9499C750

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0438.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\503872.rbs

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Windows Analysis Report
0438.pdf.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre