Edit tour

Windows Analysis Report
ivySCI-5.6.3.exe

Overview

General Information

Sample name:	ivySCI-5.6.3.exe
Analysis ID:	1561081
MD5:	a4d6d369b2bdb57b71adb6386c979397
SHA1:	d4167f19655f07001d63cf6bebf0beddebf6de35
SHA256:	2044c7daa56b6eb1730b02664788b8c559b29e2736293ba07350b3f1d9fdecd1
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	34
Range:	0 - 100

Signatures

Antivirus detection for dropped file

Drops large PE files

Sets file extension default program settings to executables

Creates a process in suspended mode (likely to inject code)

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

ivySCI-5.6.3.exe (PID: 944 cmdline: "C:\Users\user\Desktop\ivySCI-5.6.3.exe" MD5: A4D6D369B2BDB57B71ADB6386C979397)

cmd.exe (PID: 1416 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ??ivySCI.exe" | %SYSTEMROOT%\System32\find.exe "??ivySCI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4296 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 6672 cmdline: C:\Windows\System32\find.exe "??ivySCI.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

??ivySCI.exe (PID: 6056 cmdline: "C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe" MD5: 5497B6AEDAC0DEA15ABC2DCB652E19C6)

??ivySCI.exe (PID: 5052 cmdline: "C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe" MD5: 5497B6AEDAC0DEA15ABC2DCB652E19C6)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\update.exe

Avira: detection malicious, Label: HEUR/AGEN.1331988

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\xpdf\win32-x64\pdfinfo.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\elevate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\Uninstall ??ivySCI.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\xpdf\win32-x32\pdfinfo.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\ivysci-desktop-app-updater\installer.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\update.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: cmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\xpdf\win32-x64\pdfinfo.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\elevate.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\Uninstall ??ivySCI.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\xpdf\win32-x32\pdfinfo.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\ivysci-desktop-app-updater\installer.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources\extraResources\update.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: cmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	EXE: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe	Jump to behavior

Uses 32bit PE files

Source: ivySCI-5.6.3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6aed329f-68d0-5b5d-ac92-42fb9e279fb4

Jump to behavior

Creates license or readme file

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSE.electron.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: ivySCI-5.6.3.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: ivySCI-5.6.3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1565846647.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: ivySCI-5.6.3.exe, 00000000.00000003.1539624738.0000000009380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1568810392.0000000006D81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: ivySCI-5.6.3.exe, 00000000.00000003.1565846647.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1588639611.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1634295327.0000000004F11000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe	Jump to behavior

Networking

Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D88000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cldr.unicode.org/index/downloads
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/angleproject/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/google-axs-chrome/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/lao-dictionary/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/smhasher/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/v8
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/y2038
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D88000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://devel.freebsoft.org/speechd
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/ndk/index.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/sdk/index.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ejemplo.com
Source: ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eksempel.dk
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedesktop.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.github.io/snappy/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary.txt
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://llvm.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lxr.mozilla.org/mozilla/source/toolkit/mozapps/update/src/updater/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: ivySCI-5.6.3.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D88000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://oss.sgi.com/projects/FreeB/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1665319166.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://primer.com
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://software.blackmagicdesign.com/DeckLink/v10.7/Blackmagic_DeckLink_SDK_10.7.zip
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com).
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://source.android.com/compatibility)
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tukaani.org/xz/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://valgrind.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://webkit.org/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://website-archive.mozilla.org/www.mozilla.org/mpl/MPL/NPL/1.1/):
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/).
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chromium.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chromium.org/blink
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chromium.org/chromium-os
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.daemonology.net/bsdiff/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/>.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mojohaus.org/animal-sniffer/animal-sniffer-annotations/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/NPL/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)"
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.strongtalk.org/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.torchmobile.com/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/Public/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/cldr/data/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/cldr/data/.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/reports/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.webrtc.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zlib.net/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.googlesource.com/platform/external/setupdesign/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.googlesource.com/platform/frameworks/support
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aomedia.googlesource.com/aom/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beto-core.googlesource.com/beto-core
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://boringssl.googlesource.com/boringssl
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://checkerframework.org
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=am&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1638835154.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=bg&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=cs&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1644819910.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1644181860.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity
Source: ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=frCtrl$1
Source: ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=he&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1653805722.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ja&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=lt&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=lv&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sk&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1665804723.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sr&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: ivySCI-5.6.3.exe, 00000000.00000003.1673649803.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: ivySCI-5.6.3.exe, 00000000.00000003.1674137691.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: ivySCI-5.6.3.exe, 00000000.00000003.1644819910.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1671079530.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1644181860.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660614941.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645904273.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1635278813.0000000000994000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1647804376.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1669732835.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660213348.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1663083545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655413727.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/cast_core/public
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/external/google3/cros_components/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ci.android.com/builds/submitted/10565858/linux/latest/raw/android-ndk-10625055-linux-x86_64.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cla.developers.google.com/clas
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.android.com/guide/playcore.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.android.com/topic/libraries/architecture/index.html
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/android/guides/setup
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developers.google.com/ar/develop/java/enable-arcore#dependencies
Source: ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ejemplo.com.Se
Source: ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eksempel.dk.Brug
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Cyan4973/xxHash
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/IvyScience/ikran
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aawc/unrar.git
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/abseil/abseil-cpp
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/codemirror/CodeMirror.next/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/codemirror/CodeMirror/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dequelabs/axe-core/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/facebook/zstd
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google-ar/arcore-android-sdk
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/anonymous-tokens
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/brotli
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/cityhash
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/cld3
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/compact_enc_det
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/distributed_point_functions
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/private-join-and-compute
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/protobuf
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/re2
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ruy
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/securemessage
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/sentencepiece
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/shell-encryption
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/ukey2
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/woff2
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/xnnpack
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/googlevr/cardboard
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/intel/ARM_NEON_2_x86_SSE
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/intel/libva
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jquery-ui
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/liblouis/liblouis
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS).
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/plume-lib/)
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/puppeteer/replay
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rianhunter/zxcvbn-cpp
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simplejson/simplejson
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/models
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tensorflow
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/text.git
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tflite-support
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/typetools/annotation-tools)
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/typetools/jdk
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/typetools/stubparser
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wasdk/wasmparser
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/xiph/rnnoise
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/mozilla-central/file/tip/netwerk/base/nsURLParsers.cpp
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jquery.org/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://llvm.org/docs/DeveloperPolicy.html#legacy):
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://myactivity.google.com/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nuxi.nl/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: fr.pak.0.dr	String found in binary or memory: https://passwords.google.comCompte
Source: ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1653805722.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comKonta
Source: ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comT
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://policies.google.com/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://polymer-library.polymer-project.org
Source: ivySCI-5.6.3.exe, 00000000.00000003.1665319166.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://primer.com.Uporaba
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quiche.googlesource.com/quiche
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_test
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skia.org/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://source.corp.google.com/piper///depot/google3/third_party/tamachiyomi/README.md
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/project/?group_id=1519
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sqlite.org/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1671079530.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1658065545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660614941.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642698646.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645904273.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1635278813.0000000000994000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1669732835.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660213348.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667956603.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1650289135.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1663083545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655413727.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: ivySCI-5.6.3.exe, 00000000.00000003.1671079530.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1658065545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1652828718.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660614941.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642698646.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1635278813.0000000000994000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1647804376.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1669732835.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660213348.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667308334.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1659750060.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667956603.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: ivySCI-5.6.3.exe, 00000000.00000003.1645904273.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://unity3d.com/legal/branding_trademarks.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://unity3d.com/legal/licenses/Unity_Companion_License
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: zh-CN.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&AideG
Source: ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/copyright.html.

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File dump: ??ivySCI.exe.0.dr 173016664			Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File dump: ??ivySCI.exe0.0.dr 173016664			Jump to dropped file

Enables security privileges

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Process token adjusted: Security

Jump to behavior

PE file contains more sections than normal

Source: vulkan-1.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: ??ivySCI.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: ??ivySCI.exe0.0.dr	Static PE information: Number of sections : 15 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs ivySCI-5.6.3.exe
Source: ivySCI-5.6.3.exe, 00000000.00000003.1565846647.0000000006D89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs ivySCI-5.6.3.exe
Source: ivySCI-5.6.3.exe, 00000000.00000003.1588639611.0000000006D89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs ivySCI-5.6.3.exe
Source: ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2 vs ivySCI-5.6.3.exe
Source: ivySCI-5.6.3.exe, 00000000.00000003.1576011538.0000000006D82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs ivySCI-5.6.3.exe

Uses 32bit PE files

Source: ivySCI-5.6.3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal42.winEXE@10/102@0/0

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Mutant created: \Sessions\1\BaseNamedObjects\6aed329f-68d0-5b5d-ac92-42fb9e279fb4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5204:120:WilError_03

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File created: C:\Users\user\AppData\Local\Temp\nst2C19.tmp

Jump to behavior

Source: ivySCI-5.6.3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IVYSCI.EXE'

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File read: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ivySCI-5.6.3.exe "C:\Users\user\Desktop\ivySCI-5.6.3.exe"
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ??ivySCI.exe" \| %SYSTEMROOT%\System32\find.exe "??ivySCI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "??ivySCI.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe "C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe "C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe"
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ??ivySCI.exe" \| %SYSTEMROOT%\System32\find.exe "??ivySCI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "??ivySCI.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: fsutilext.dll	Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe"

Creates a software uninstall entry

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6aed329f-68d0-5b5d-ac92-42fb9e279fb4

Jump to behavior

PE / OLE file has a valid certificate

Source: ivySCI-5.6.3.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: ivySCI-5.6.3.exe

Static file information: File size 75040080 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: ivySCI-5.6.3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1565846647.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: ivySCI-5.6.3.exe, 00000000.00000003.1539624738.0000000009380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1568810392.0000000006D81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: ivySCI-5.6.3.exe, 00000000.00000003.1565846647.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1588639611.0000000006D89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: ivySCI-5.6.3.exe, 00000000.00000003.1634295327.0000000004F11000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

PE file contains sections with non-standard names

Source: ??ivySCI.exe.0.dr	Static PE information: section name: .00cfg
Source: ??ivySCI.exe.0.dr	Static PE information: section name: .gxfg
Source: ??ivySCI.exe.0.dr	Static PE information: section name: .retplne
Source: ??ivySCI.exe.0.dr	Static PE information: section name: .rodata
Source: ??ivySCI.exe.0.dr	Static PE information: section name: CPADinfo
Source: ??ivySCI.exe.0.dr	Static PE information: section name: LZMADEC
Source: ??ivySCI.exe.0.dr	Static PE information: section name: _RDATA
Source: ??ivySCI.exe.0.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: .00cfg
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: .gxfg
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: .retplne
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: .rodata
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: CPADinfo
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: LZMADEC
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: _RDATA
Source: ??ivySCI.exe0.0.dr	Static PE information: section name: malloc_h
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: update.exe.0.dr	Static PE information: section name: .code
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x32\pdfinfo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x64\pdfinfo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\??ivySCI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\update.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File created: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSE.electron.txt			Jump to behavior

Boot Survival

Sets file extension default program settings to executables

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ivysci\shell\Open\command C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\..ivySCI.exe %1

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??ivySCI.lnk

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x32\pdfinfo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x64\pdfinfo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\update.exe	Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	File opened: C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe	Jump to behavior

Source: ivySCI-5.6.3.exe, 00000000.00000003.1568810392.0000000006D81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgab
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: * Neither the name of the VMware, Inc. nor the names of its contributors
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE FOR
Source: ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Copyright (c) 2011, VMware, Inc.
Source: ivySCI-5.6.3.exe, 00000000.00000003.1568810392.0000000006D81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\ivySCI-5.6.3.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ??ivySCI.exe" \| %SYSTEMROOT%\System32\find.exe "??ivySCI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "??ivySCI.exe"	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	11 Process Injection	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Search Order Hijacking	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\update.exe	100%	Avira	HEUR/AGEN.1331988
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\darwin-arm64\pdfinfo	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\darwin-x64\pdfinfo	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\linux-x64\pdfinfo	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsis7z.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://source.android.com).	0%	Avira URL Cloud	safe
https://boringssl.googlesource.com/boringssl	0%	Avira URL Cloud	safe
http://www.torchmobile.com/	0%	Avira URL Cloud	safe
https://aomedia.googlesource.com/aom/	0%	Avira URL Cloud	safe
https://beto-core.googlesource.com/beto-core	0%	Avira URL Cloud	safe
https://checkerframework.org	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/liblouis/liblouis	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/simplejson/simplejson	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.android.com/guide/playcore.	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/abseil/abseil-cpp	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	ivySCI-5.6.3.exe, 00000000.00000003.1671079530.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1658065545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1652828718.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660614941.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642698646.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1635278813.0000000000994000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1647804376.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1669732835.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660213348.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667308334.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1659750060.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667956603.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://webkit.org/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.freedesktop.org/wiki/Software/xdg-user-dirs	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.google.com/p/angleproject/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
http://source.android.com).	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.apache.org/licenses/LICENSE-2.0	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
http://www.chromium.org/blink	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.linux-usb.org/usb-ids.html	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tukaani.org/xz/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://beto-core.googlesource.com/beto-core	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=sk&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://boringssl.googlesource.com/boringssl	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/google/pprof/tree/master/proto	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jrmuizel/qcms/tree/v4	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.unicode.org/cldr/data/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromium.googlesource.com/chromium/src/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aomedia.googlesource.com/aom/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&AideG	fr.pak.0.dr	false		high
https://github.com/plume-lib/)	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=cs&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=sr&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1665804723.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/typetools/annotation-tools)	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://primer.com.Uporaba	ivySCI-5.6.3.exe, 00000000.00000003.1665319166.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google-ar/arcore-android-sdk	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/aawc/unrar.git	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/models	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/KhronosGroup/SPIRV-Headers.git	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity	ivySCI-5.6.3.exe, 00000000.00000003.1644181860.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/tflite-support	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/tensorflow	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.webrtc.org	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.unicode.org/cldr/data/.	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sqlite.org/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/Cyan4973/xxHash	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.google.com/p/google-axs-chrome/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.ploscompbiol.org/static/license	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google/xnnpack	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/a/answer/9122284	ivySCI-5.6.3.exe, 00000000.00000003.1671079530.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1658065545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1649360887.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672029050.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660614941.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1636783259.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642698646.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1645904273.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1635278813.0000000000994000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1669732835.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1642116954.0000000000997000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1660213348.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1667956603.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1650289135.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1663083545.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1655413727.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google/cityhash	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://source.android.com	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.google.com/p/y2038	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/KhronosGroup/Vulkan-Loader	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=ar&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1637717827.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/SeleniumHQ/selenium/tree/trunk	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gitlab.freedesktop.org/xdg/xdgmime	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.unicode.org/copyright.html	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/ruy	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://llvm.org	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://polymer-library.polymer-project.org	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google/shell-encryption	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zlib.net/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/wasdk/wasmparser	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://passwords.google.comCompte	fr.pak.0.dr	false		high
http://mozilla.org/MPL/2.0/.	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
http://int3.de/	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/).	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/compact_enc_det	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/protobuf	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://llvm.org/docs/DeveloperPolicy.html#legacy):	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/puppeteer/replay	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com02	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	ivySCI-5.6.3.exe, 00000000.00000003.1655978905.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1664420516.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1657016171.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1641203960.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1648398861.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1661006187.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, zh-CN.pak.0.dr, fr.pak.0.dr	false		high
http://google.github.io/snappy/	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://policies.google.com/	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
http://repository.certum.pl/ctnca2.cer09	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromium.googlesource.com/webm/libwebp	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unity3d.com/legal/licenses/Unity_Companion_License	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/typetools/jdk	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.gutenberg.org/ebooks/53).	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ejemplo.com.Se	ivySCI-5.6.3.exe, 00000000.00000003.1645388083.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false		high
http://valgrind.org	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.gnu.org/licenses/>.	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromium.googlesource.com/webm/libwebm	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkerframework.org	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/category/extensions	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/google/anonymous-tokens	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u	ivySCI-5.6.3.exe, 00000000.00000003.1651805308.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developers.google.com/ar/develop/java/enable-arcore#dependencies	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://passwords.google.comT	ivySCI-5.6.3.exe, 00000000.00000003.1672897836.0000000004F11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/google/distributed_point_functions	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.torchmobile.com/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/google/cld3	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.00000000077B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/wuffs-mirror-release-c	ivySCI-5.6.3.exe, 00000000.00000003.1580018702.0000000006D83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.unicode.org/reports/	ivySCI-5.6.3.exe, 00000000.00000003.1332790080.0000000007432000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.certum.pl/CPS0	ivySCI-5.6.3.exe, 00000000.00000003.1678214276.0000000004F11000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1680398774.0000000004F91000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1679898941.0000000004F29000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1431727706.0000000007220000.00000004.00001000.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1592395302.0000000006D9A000.00000004.00000020.00020000.00000000.sdmp, ivySCI-5.6.3.exe, 00000000.00000002.2002876307.000000000041E000.00000004.00000001.01000000.00000003.sdmp, ivySCI-5.6.3.exe, 00000000.00000003.1433697135.00000000073A0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561081
Start date and time:	2024-11-22 18:45:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	ivySCI-5.6.3.exe
Detection:	MAL
Classification:	mal42.winEXE@10/102@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.158.35, 2.16.158.179, 2.16.158.192, 2.16.158.33, 2.16.158.186, 2.16.158.27, 2.16.158.43, 2.16.158.185, 2.16.158.26
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, slscr.update.microsoft.com, login.live.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: ivySCI-5.6.3.exe

Simulations

Behavior and APIs

Time	Type	Description
12:46:41	API Interceptor	14x Sleep call for process: ivySCI-5.6.3.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll	MayitaV16.exe	Get hash	malicious	Unknown	Browse
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173016664
Entropy (8bit):	6.730512154098745
Encrypted:	false
SSDEEP:	1572864:XlEi9SeCO4oqGTPka5WpZvcVLk0KQGQt7BF/PFMQOkb6fQMl+x9XYpevecsjHQjz:62j8jSt7FjMdTQ
MD5:	5497B6AEDAC0DEA15ABC2DCB652E19C6
SHA1:	FD8228DE024417850A7F445755D268C0DE0C62DE
SHA-256:	37CFF0B9FF92A1EAE914069115E210A94A6116EB93113DB90AC048979024D917
SHA-512:	78829B1558DA400D757DF9FE0F36E1007355C4A746B283F637C60256E0B44D50A5E51EE068A1F21F6F3987596C23B84AD09BAA6586FBEE9E922FB28A147191D9
Malicious:	true
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........."......0o..X.......wj........@.............................p......`.P...`..............................................C..m...T....pw.$t...`2.0.D...O.XR....}..x...j.......................d..(....]o.@........... ...X...hq..`....................text...%/o......0o................. ..`.rdata..8.}..@o...~..4o.............@..@.data.....E..@.......4..............@....pdata..0.D..`2.. D..,..............@..@.00cfg..0.....v......L:.............@..@.gxfg... C....v..D...N:.............@..@.retplne......v.......:..................rodata.......v.......:............. ..`.tls..........w.......:.............@...CPADinfo8.... w.......:.............@...LZMADEC......0w.......:............. ..`_RDATA..\....Pw.......:.............@..@malloc_h.....`w.......:............. ..`.rsrc...$t...pw..v....:.............@..@.reloc...x....}..z...:A.............@..B................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9227221
Entropy (8bit):	4.785730097444693
Encrypted:	false
SSDEEP:	24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
MD5:	2675B30D524B6C79B6CEE41AF86FC619
SHA1:	407716C1BB83C211BCB51EFBBCB6BF2EF1664E5B
SHA-256:	6A717038F81271F62318212F00B1A2173B9CB0CC435F984710AC8355EB409081
SHA-512:	3214341DA8BF3347A6874535BB0FF8D059EE604E779491780F2B29172F9963E23ACBE3C534D888F7A3B99274F46D0628962E1E72A5D3FC6F18CA2B62343DF485
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may use, copy, modify this code for any purpose

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	135642
Entropy (8bit):	7.916363227461705
Encrypted:	false
SSDEEP:	3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
MD5:	A0E681FDD4613E0FFF6FB8BF33A00EF1
SHA1:	6789BACFE0B244AB6872BD3ACC1E92030276011E
SHA-256:	86F6B8FFA8788603A433D425A4BC3C4031E5D394762FD53257B0D4B1CFB2FFA2
SHA-512:	6F6A1A8BFE3D33F3FA5F6134DAC7CD8C017E38E5E2A75A93A958ADDBB17A601C5707D99A2AF67E52C0A3D5206142209703701CD3FAB44E0323A4553CAEE86196
Malicious:	false
Preview:	....................5...........r..........._.......................P.....J.................c!.....#....#......8.....;.....@....PC.....E.....G....8J....(L....XN.....R.....U..!..Y.."..Z..$..[..&..]..'..^....]_../.we..0..k..1./m..2..m.....n.....o.....q.....t....xw.....z.....~..........,...........................w.........0....{....@....C....y....v.......................................u"...K)....+.../...t3....=...!@...xH...]L....U...5`....pd.....f.....n....Lw....4x.....y.....{.....~....W.....l...........'...........b.......................`............................p................r.....w...0.\|...1.<...2.....3.....4.$...5.....6....7.....8.....9.s...:....;....<.....=.r...>.`...?.x...@.~...A.8...C.....D.....E.....F.W...G.!...H.....I.....J.....K.....L.....O.....&.....'.....(.5...)......*...+.T...,.!...-.k........./.....0.Y...1.....2.....3.....4.....5.....6.!...7.....8.7...9.....:.P...<.....=.-...>.....?.....@.Y...A.....B.{...C.....D.-...E.....F...

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	195396
Entropy (8bit):	7.94178165609805
Encrypted:	false
SSDEEP:	3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
MD5:	C37BD7A6B677A37313B7ECC4FF01B6F5
SHA1:	79DB970C44347BD3566CEFB6CABD1995E8E173DF
SHA-256:	8C1AE81D19FD6323A02EB460E075E2F25ABA322BC7D46F2E6EDB1C4600E6537A
SHA-512:	A7B07133FA05593B102A0E5E5788B29488CB74656C5EE25DE897C2BA2B2A7B05C0663ADE74A003F7D6DF2134D0B75F0AD25E15E9C9E0969E9453B7FC40B9F8BB
Malicious:	false
Preview:	....................<..........................................$.....).....,....N4.....8.....@.....D....;Y.....m.....s....y}.........e...........W...........>.....b.....k...!.%...".}...$.....&.....'........../.#...0.....1.(...2.......$...........9.....-.....2.....q...........d...................................m.........&F...qP...6S....W....a....c...ff....k....v...sx..................~....`................F....r............r.....................s........................................E.................W.............................. ....5#....2....P-....i4.....<....[?.....f.....g....bl..0.Eq..1.sr..2..t..3..u..4.lv..5..w..6.ry..7..z..8.v\|..9..~..:.....;.I...<.7...=.....>.....?.....@.....A....C.....D.....E....F.....G.9...H.Z...I.N...J."...K....L.....O.D...&.>...'.....(.....).[........+.<...,.....-.k........./.)...0.}...1.....2.....3.....4.r...5.....6.....7.$...8.....9.U...:.....<.....=.....>.....?.P...@.....A.k...B.,...C.....D.*...E.....F.$.

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MayitaV16.exe, Detection: malicious, Browse Filename: Xa04iTOvv5.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse Filename: Xeno Executor Setup 1.0.0.exe, Detection: malicious, Browse Filename: Xeno Executor Setup 1.0.0.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2887680
Entropy (8bit):	6.709067635172478
Encrypted:	false
SSDEEP:	49152:OF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ1SCu:OFvSkJXv+tiLAD0+D1S5
MD5:	3196052D7B9D9F2725F047D94BE4309A
SHA1:	F59E0302A67BCE2B654185D64635517327196089
SHA-256:	FA8CE5EFC8F16180BB0DB6783A71CA8582B425AF3DDD9DE75F7810BB119913C7
SHA-512:	06E3FD27345D39EC4E6F2B1CEB37CE576D826899BF3CE4DE4C2690E2CD304142A8F4D597FD800892E65362F985810C8385DC47C8BA4704737859752CFC4D0F97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." ......#.........p........................................PB...........`A........................................x)....../.(.............@...............B..4....).......................).(....B#.@............3.P............................text...5.#.......#................. ..`.rdata..$....0#.......#.............@..@.data...........".................@....pdata........@....................@..@.00cfg..8.....A.......+.............@..@.gxfg... -....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....B.......+.............@..@.reloc...4....B..4....+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	488960
Entropy (8bit):	6.346963109821377
Encrypted:	false
SSDEEP:	6144:+8hd1BSjuMmof2SEXVVfgV8hxN7h2N6IEOg51f0FticyQ:+8DXSjZmof2SEsmN12N6IE7f0FticyQ
MD5:	409F766365467860629146EAA0B6F684
SHA1:	D7F795791224EA44E6145B38533370075E2FB398
SHA-256:	BB8E73E1FBCBAA4ABF9104FD5C95CAF750C4253C8B764E9889595797DD5ECFBF
SHA-512:	A0957212144772E1CFA18CA50E397074B8A1D6E8C5E8F3F578AA4EFBEF8A02AE4DD1BAEA87B9DCFB48425005D822318E21D5B2D5D5C518F32517ECD4E58455B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .....6...:......@........................................ ............`A.........................................E..h....S..(.......x....@..(D..............T....=.......................<..(...@Q..@........... W...............................text....5.......6.................. ..`.rdata......P.......:..............@..@.data....K....... ..................@....pdata..(D...@...F..................@..@.00cfg..8............2..............@..@.gxfg...0&.......(...4..............@..@.retplne.............\...................tls....!............^..............@..._RDATA..\............`..............@..@.rsrc...x............b..............@..@.reloc..T............h..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7617024
Entropy (8bit):	6.483268416240843
Encrypted:	false
SSDEEP:	98304:/wY1sQqaLe2Egto8U4r5Pp6TlITQZ3MW888888888tb8d6i:YNaSgtvroZM
MD5:	637A0A00F789DB896723BCF40E8B1592
SHA1:	995CB389963A6918D82925C86EF50454010B8D91
SHA-256:	47DA5ED03648B5CC50F224CBD181DBBE70E6915580B323C5ACC3F2B25F1C2596
SHA-512:	768E2E566A633CDEAB1B2FB3A341AF091ADD4ACBFC7A912A08BFE83697A94A510CEFAADFDC592DD1CFC530819CA7071BEAE6D948C5BD55DEFEEAF7BA26253697
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." ......X..B.......CL......................................@u...........`A..........................................k......\|l.d....Pt.......q..[...........`t......:k.....................`9k.(.....Y.@.............l..... .k.@....................text.....X.......X................. ..`.rdata...T....Y..V....X.............@..@.data...t....pm......Lm.............@....pdata...[....q..\....p.............@..@.00cfg..8.....s......,s.............@..@.gxfg....,....s.......s.............@..@.retplne..... t......\s..................tls....B....0t......^s.............@..._RDATA..\....@t......`s.............@..@.rsrc........Pt......bs.............@..@.reloc.......`t......hs.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	5483537
Entropy (8bit):	7.995680005569416
Encrypted:	true
SSDEEP:	98304:+APFNXMmWPVctFCZcSENQjxh1Z/p6uNXrwrXRVunEVvXjAfz3hIkrT7s:+APFNXMddCM0Ghz/xpkrX2nEVvXGqkXA
MD5:	E2088909E43552AD3E9CCE053740185D
SHA1:	24B23DD4CAD49340D88B9CB34E54C3CA0EB0D27F
SHA-256:	BBA36D4D18D64D9627F54C54FD645C5BA459D25A59ACC5228210BD707AEF67FD
SHA-512:	DCEFACDDEC38D8941C7D2D7B971B6F22DD0ACB4116E48891D1D48A4D88968DA12B152CCB7591715C88F8E14C315E235D1C4E6852CC38B9246091C50226900DE6
Malicious:	false
Preview:	........@...f.....{.2..\|..-..~..0.....C....;E....iF....rQ......................+.................V...........q...........L.....l.....J..........<.....<.....<.....<c....<.....<"....</....<.....<.....<`3...<V:...<a>...<.>..I=.>..J=.C..K=.D..R=XI..S=.S..T=.a..[=s...\="...]=....^=...._=...`=(...a=....b=<...c=...e=r...f=.....=.....=.....=.....=.....=.....=4....=3....=7....=.....=.....E....+E....,E@...-E.....E. ../E.+..8E.<..9E.N..:E.`..BJ.l..CJ)y..DJ=...EJ...FJ....GJ\...HJr...IJ....JJ...KJZ...LJ....(K...)K....J[...K[....L[.)..M[.+..N[G-..O[.0..P[.2..Q[.5...[.D...[.I...[.N...[o]...[d`...[.e...[.f...[Ah...\.i...\.r...\!x...\.~...\y....\....\8....\....\.....\....\Z....\.....\.....\!....\,....\.....\.....\.\|...\........................>.....t...........t.....e...........1..........G.....M...........?...........n...........".........9.........b.........y.........<.....u.......7..........O....................o.........................a...........-.....1.....y.

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	267462
Entropy (8bit):	4.19770221494855
Encrypted:	false
SSDEEP:	3072:8LuAqiYp4bhaz8Le7ICHKhsqdzoGq/p2Vy:hiHbhaMAIyAsqxip2Q
MD5:	6FCB8A6C21A7E76A7BE2DC237B64916F
SHA1:	893EF10567F7705144F407A6493A96AB341C7CCF
SHA-256:	2BCEEF4822CA7CC3ADD4A9DCB67C51EFB51C656FCE96A3B840250DE15379959C
SHA-512:	3B745740BBBE339542EF03FD15DD631FB775E6BF8CA54D6D2B9CEAD3AA5AAFC4CAB49E507BC93641E581412BBEB916A53608D5F5D971EA453779E72D2294DAFB
Malicious:	false
Preview:	........a...1.Nk11.8.172.18-electron.0...........................................@..fT...l...........?..a........a........a........ar.......a8.......a............e....f...bf....f..."g....g....g...Bh....h....i...bi....i..."j..(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	626313
Entropy (8bit):	5.180772010538009
Encrypted:	false
SSDEEP:	6144:jMWiyz4J+1OFZAsXbJ8qPOzhXvKwvrBTbvUyMR/GLrOp:j2+lOF4h/DvNHvUiap
MD5:	1A37F6614FF8799B1C063BC83C157CC3
SHA1:	8238B9295E1DDE9DE0D6FD20578E82703131A228
SHA-256:	4FBE07F71B706C2A2948EBA9A6B1979E23C83342B190723A6EC5251B2D6DAD7C
SHA-512:	6677F65A0E26FDC2CFF6CEF0231F5E5F0713EE7C5CF7F488599A3C7AC3E8365AFAEC10B35D6145EA58D364151D8BCB08308765693A9797EA99B894D6E8224AC7
Malicious:	false
Preview:	..........N5<Dk11.8.172.18-electron.0..............................................1....8.......E..........0...a........a........aT.......ar.......a8.......a............e....f...bf....f..."g....g....g...Bh....h....i...bi....i..."j..(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5180416
Entropy (8bit):	6.360584977154033
Encrypted:	false
SSDEEP:	49152:Y6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzo:5h3aMXoSHfPwksHldLiuNr
MD5:	2B032D9C66F8644B0A1D157968D46557
SHA1:	9426C4CA56C9A07789127D9691CD1139020DB773
SHA-256:	233445E46B2CC443964FA4CB9074DB65D66027C6DD4E73799D58DE06A76E0200
SHA-512:	5841C378DA834572D8ED6AF37080E6FDE945A635737EDE78919F9CB2E9942CB8430F1706ACFC8805DB65D807C12F6032A70181CCB13EC3B413DFFA4CB3C8C6A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .....h>......... 17.......................................P...........`A.........................................`J.~.....J.P.....P......0N..g........... P..}....J.......................J.(...@.>.@.............J.P............................text....f>......h>................. ..`.rdata..L.....>......l>.............@..@.data...P....pK......PK.............@....pdata...g...0N..h....L.............@..@.00cfg..8.....O......RN.............@..@.gxfg....-....O......TN.............@..@.retplne......O.......N..................tls....Y.....O.......N.............@..._RDATA..\.....P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}... P..~....N.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	953856
Entropy (8bit):	6.582979756960565
Encrypted:	false
SSDEEP:	24576:oYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sZ:oY65/M387R56Z5WoDYsHY6g3P0zAk7s
MD5:	BF294513509A6A782E30232442E76026
SHA1:	4C81C44029578F8A6978628D1469EA4DB89B3658
SHA-256:	67E799F325A88D53869FDFFCABBFE1D662336186C535B11EAB3BFD57E41442D9
SHA-512:	63A85967165ABA30EF39FDAC3C4F591A369C3123E1B5C9DCF40256D2A3C223282AA1BEFD08B18596CDFE8113A8716EFD07848DF7E12A4CE161736A94F53B5F29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .........................................................0............`A........................................p...<!...3..P............ ...s........... ..L...............................(...@...@............7...............................text.............................. ..`.rdata..............................@..@.data...(M....... ..................@....pdata...s... ...t..................@..@.00cfg..8............J..............@..@.gxfg...P).......*...L..............@..@.retplne.............v...................tls.................x..............@..._RDATA..\............z..............@..@.rsrc................\|..............@..@.reloc..L.... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\??ivySCI.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173016664
Entropy (8bit):	6.730512154098745
Encrypted:	false
SSDEEP:	1572864:XlEi9SeCO4oqGTPka5WpZvcVLk0KQGQt7BF/PFMQOkb6fQMl+x9XYpevecsjHQjz:62j8jSt7FjMdTQ
MD5:	5497B6AEDAC0DEA15ABC2DCB652E19C6
SHA1:	FD8228DE024417850A7F445755D268C0DE0C62DE
SHA-256:	37CFF0B9FF92A1EAE914069115E210A94A6116EB93113DB90AC048979024D917
SHA-512:	78829B1558DA400D757DF9FE0F36E1007355C4A746B283F637C60256E0B44D50A5E51EE068A1F21F6F3987596C23B84AD09BAA6586FBEE9E922FB28A147191D9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........."......0o..X.......wj........@.............................p......`.P...`..............................................C..m...T....pw.$t...`2.0.D...O.XR....}..x...j.......................d..(....]o.@........... ...X...hq..`....................text...%/o......0o................. ..`.rdata..8.}..@o...~..4o.............@..@.data.....E..@.......4..............@....pdata..0.D..`2.. D..,..............@..@.00cfg..0.....v......L:.............@..@.gxfg... C....v..D...N:.............@..@.retplne......v.......:..................rodata.......v.......:............. ..`.tls..........w.......:.............@...CPADinfo8.... w.......:.............@...LZMADEC......0w.......:............. ..`_RDATA..\....Pw.......:.............@..@malloc_h.....`w.......:............. ..`.rsrc...$t...pw..v....:.............@..@.reloc...x....}..z...:A.............@..B................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9227221
Entropy (8bit):	4.785730097444693
Encrypted:	false
SSDEEP:	24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
MD5:	2675B30D524B6C79B6CEE41AF86FC619
SHA1:	407716C1BB83C211BCB51EFBBCB6BF2EF1664E5B
SHA-256:	6A717038F81271F62318212F00B1A2173B9CB0CC435F984710AC8355EB409081
SHA-512:	3214341DA8BF3347A6874535BB0FF8D059EE604E779491780F2B29172F9963E23ACBE3C534D888F7A3B99274F46D0628962E1E72A5D3FC6F18CA2B62343DF485
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may use, copy, modify this code for any purpose

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	135642
Entropy (8bit):	7.916363227461705
Encrypted:	false
SSDEEP:	3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
MD5:	A0E681FDD4613E0FFF6FB8BF33A00EF1
SHA1:	6789BACFE0B244AB6872BD3ACC1E92030276011E
SHA-256:	86F6B8FFA8788603A433D425A4BC3C4031E5D394762FD53257B0D4B1CFB2FFA2
SHA-512:	6F6A1A8BFE3D33F3FA5F6134DAC7CD8C017E38E5E2A75A93A958ADDBB17A601C5707D99A2AF67E52C0A3D5206142209703701CD3FAB44E0323A4553CAEE86196
Malicious:	false
Preview:	....................5...........r..........._.......................P.....J.................c!.....#....#......8.....;.....@....PC.....E.....G....8J....(L....XN.....R.....U..!..Y.."..Z..$..[..&..]..'..^....]_../.we..0..k..1./m..2..m.....n.....o.....q.....t....xw.....z.....~..........,...........................w.........0....{....@....C....y....v.......................................u"...K)....+.../...t3....=...!@...xH...]L....U...5`....pd.....f.....n....Lw....4x.....y.....{.....~....W.....l...........'...........b.......................`............................p................r.....w...0.\|...1.<...2.....3.....4.$...5.....6....7.....8.....9.s...:....;....<.....=.r...>.`...?.x...@.~...A.8...C.....D.....E.....F.W...G.!...H.....I.....J.....K.....L.....O.....&.....'.....(.5...)......*...+.T...,.!...-.k........./.....0.Y...1.....2.....3.....4.....5.....6.!...7.....8.7...9.....:.P...<.....=.-...>.....?.....@.Y...A.....B.{...C.....D.-...E.....F...

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	195396
Entropy (8bit):	7.94178165609805
Encrypted:	false
SSDEEP:	3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
MD5:	C37BD7A6B677A37313B7ECC4FF01B6F5
SHA1:	79DB970C44347BD3566CEFB6CABD1995E8E173DF
SHA-256:	8C1AE81D19FD6323A02EB460E075E2F25ABA322BC7D46F2E6EDB1C4600E6537A
SHA-512:	A7B07133FA05593B102A0E5E5788B29488CB74656C5EE25DE897C2BA2B2A7B05C0663ADE74A003F7D6DF2134D0B75F0AD25E15E9C9E0969E9453B7FC40B9F8BB
Malicious:	false
Preview:	....................<..........................................$.....).....,....N4.....8.....@.....D....;Y.....m.....s....y}.........e...........W...........>.....b.....k...!.%...".}...$.....&.....'........../.#...0.....1.(...2.......$...........9.....-.....2.....q...........d...................................m.........&F...qP...6S....W....a....c...ff....k....v...sx..................~....`................F....r............r.....................s........................................E.................W.............................. ....5#....2....P-....i4.....<....[?.....f.....g....bl..0.Eq..1.sr..2..t..3..u..4.lv..5..w..6.ry..7..z..8.v\|..9..~..:.....;.I...<.7...=.....>.....?.....@.....A....C.....D.....E....F.....G.9...H.Z...I.N...J."...K....L.....O.D...&.>...'.....(.....).[........+.<...,.....-.k........./.)...0.}...1.....2.....3.....4.r...5.....6.....7.$...8.....9.U...:.....<.....=.....>.....?.P...@.....A.k...B.,...C.....D.*...E.....F.$.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2887680
Entropy (8bit):	6.709067635172478
Encrypted:	false
SSDEEP:	49152:OF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ1SCu:OFvSkJXv+tiLAD0+D1S5
MD5:	3196052D7B9D9F2725F047D94BE4309A
SHA1:	F59E0302A67BCE2B654185D64635517327196089
SHA-256:	FA8CE5EFC8F16180BB0DB6783A71CA8582B425AF3DDD9DE75F7810BB119913C7
SHA-512:	06E3FD27345D39EC4E6F2B1CEB37CE576D826899BF3CE4DE4C2690E2CD304142A8F4D597FD800892E65362F985810C8385DC47C8BA4704737859752CFC4D0F97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." ......#.........p........................................PB...........`A........................................x)....../.(.............@...............B..4....).......................).(....B#.@............3.P............................text...5.#.......#................. ..`.rdata..$....0#.......#.............@..@.data...........".................@....pdata........@....................@..@.00cfg..8.....A.......+.............@..@.gxfg... -....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....B.......+.............@..@.reloc...4....B..4....+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	488960
Entropy (8bit):	6.346963109821377
Encrypted:	false
SSDEEP:	6144:+8hd1BSjuMmof2SEXVVfgV8hxN7h2N6IEOg51f0FticyQ:+8DXSjZmof2SEsmN12N6IE7f0FticyQ
MD5:	409F766365467860629146EAA0B6F684
SHA1:	D7F795791224EA44E6145B38533370075E2FB398
SHA-256:	BB8E73E1FBCBAA4ABF9104FD5C95CAF750C4253C8B764E9889595797DD5ECFBF
SHA-512:	A0957212144772E1CFA18CA50E397074B8A1D6E8C5E8F3F578AA4EFBEF8A02AE4DD1BAEA87B9DCFB48425005D822318E21D5B2D5D5C518F32517ECD4E58455B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .....6...:......@........................................ ............`A.........................................E..h....S..(.......x....@..(D..............T....=.......................<..(...@Q..@........... W...............................text....5.......6.................. ..`.rdata......P.......:..............@..@.data....K....... ..................@....pdata..(D...@...F..................@..@.00cfg..8............2..............@..@.gxfg...0&.......(...4..............@..@.retplne.............\...................tls....!............^..............@..._RDATA..\............`..............@..@.rsrc...x............b..............@..@.reloc..T............h..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7617024
Entropy (8bit):	6.483268416240843
Encrypted:	false
SSDEEP:	98304:/wY1sQqaLe2Egto8U4r5Pp6TlITQZ3MW888888888tb8d6i:YNaSgtvroZM
MD5:	637A0A00F789DB896723BCF40E8B1592
SHA1:	995CB389963A6918D82925C86EF50454010B8D91
SHA-256:	47DA5ED03648B5CC50F224CBD181DBBE70E6915580B323C5ACC3F2B25F1C2596
SHA-512:	768E2E566A633CDEAB1B2FB3A341AF091ADD4ACBFC7A912A08BFE83697A94A510CEFAADFDC592DD1CFC530819CA7071BEAE6D948C5BD55DEFEEAF7BA26253697
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." ......X..B.......CL......................................@u...........`A..........................................k......\|l.d....Pt.......q..[...........`t......:k.....................`9k.(.....Y.@.............l..... .k.@....................text.....X.......X................. ..`.rdata...T....Y..V....X.............@..@.data...t....pm......Lm.............@....pdata...[....q..\....p.............@..@.00cfg..8.....s......,s.............@..@.gxfg....,....s.......s.............@..@.retplne..... t......\s..................tls....B....0t......^s.............@..._RDATA..\....@t......`s.............@..@.rsrc........Pt......bs.............@..@.reloc.......`t......hs.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	457927
Entropy (8bit):	5.4171857958645475
Encrypted:	false
SSDEEP:	12288:/cqYYWk0o+wZiSMKVQ2uM2Z12JynA7PIrfsdgSTCSQ2fs37KQOb5t/tn6A/HiaHU:ynk0ofMSMaTuM2Z12JynA7PIrfsdgST4
MD5:	917A688D64ECCF67FEF5A5EB0908B6D4
SHA1:	7206B01BBC3FD8CC937DB9050DD8AC86CF44D8CC
SHA-256:	6981249837AD767FC030EDC8838878A5E493FB08CC49982CFFAED16CFBEB564D
SHA-512:	195DBEC8463CF89990232296C5C927E1501F0C2E01A7BE7C6A6ACAE651853CE1EDB23D639AF65979B39A3C61979119C3A305ACFA3AADF0CB93E241C5E57F4534
Malicious:	false
Preview:	........_#t.e.....h.$...i.,...j.8...k.G...l.R...n.Z...o._...p.l...q.r...r.~...s.....t.....v.....w.....y.....z.....\|.....}.................................................!.....".....#.....(.....5.....D.....U.....h...........V.......................v.................1.......................`.......................Y.......................4.......................(.....v.................7.......................C.......................?.......................J.......................{...........-.....D.............................X.............................S.....r.....{.........../....._.....n...........#.....U.....e.................'.....0.............................J.......................D.......................d.......................D.......................".....h.......................p.................=.....{.......................\.......................T.................6.........................................P.................H.....[.............................x.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	744722
Entropy (8bit):	4.880240690992002
Encrypted:	false
SSDEEP:	12288:LMlGLQXTZou76VIx2TERZ3ej5dMNzLY5S9ZSVrBO0Pcx30jH8+F:Lc9XTZsVIxJRZuj5dMNzLY5S9ZSVrBOg
MD5:	3CFD7C5BB92AB72C63E003208A9E4529
SHA1:	165D2F69AB6A6E237F0FEC943B5577123CEFEA87
SHA-256:	12E9E1BEC1C46E5EA706157726E17A4429ACF288A5754FA183BD9B4CF7D3853B
SHA-512:	CD7C7837D758EA66ABC871503CDA6FE99FF45990405E60C1133E7C1F4CB29EE69723C9558BB2D3ECCB42948DA57351F4F095062616686AB2E255ACD3C86236F0
Malicious:	false
Preview:	........s#`.e.D...h.L...i.W...j.c...k.r...l.}...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....S.....o.........................................8.................(.....T.....+...........q...........c...........n...................................q...........6.....L...........n.......................\|.........................................L...........:....._.........................................7.....f...........;.....a.................l..............................................:.................^...........N.....d.............................}...........O.....n...........r.................~.....,.................N................. .................T.....\|.....................................................H..................................p...........J...........,.....U.................r ..... ....W!.....!....l"....."....j#.....$....~$.....$.....%....d%.....%.....%....V&.....&....T'

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	813209
Entropy (8bit):	4.897933532023867
Encrypted:	false
SSDEEP:	12288:EyBYh5/N/RaWH4gzWvwU5Twikcb5uNi3+D2qeTT:E3aR/5D+M
MD5:	3C2AB7363018DB1F20B90ACBC305CB4C
SHA1:	60B9CF453178AD0E60FAF20D137A0C7EABDE65C9
SHA-256:	3CA47B9C436723F837A53B2904B51EFDF13AB6CAD2F3EF4FE48A1115847ECCBF
SHA-512:	589BEB3E95E93F30341933C9B9826210E6BF3E9C1AD8F113D9D8A98FA5A526F81E454EE3357FB55D60D67A4890CE33E964BA2FA810E1771A6B7E82746492313A
Malicious:	false
Preview:	........4#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.+...s.<...t.E...v.Z...w.g...y.m...z.\|...\|.....}...............................................................................B.....t.....^.....L.......................S.................{.....-.................r.....".................7.................(.................E.....\.......................-....................... .................S.............................5.......................,.....3..... .............................7.................u.................E.................'........................................._.....p......................."...........'.....h...................................y...........{...................................~...........%.........................................R.................l.................M.................:...........1.....~.................. ....4!....a!....."....."....."....(#.....#....6$....x$.....$.....$....X%....~%.....%....R&.....&....Y'....{'.....(

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	848303
Entropy (8bit):	4.65032463396985
Encrypted:	false
SSDEEP:	24576:T3ChsqKaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao57JqueRSnQFwN/6B:TChsqKaElYtUjHh373Z53a1kVDgQw1dn
MD5:	A69F6075863D47B564A2FEB655A2946F
SHA1:	062232499FF73D39724C05C0DF121ECD252B8A31
SHA-256:	A5EB7038ED956BAD7704A722F05691474FF709DFFBAD92B8E31DBB869AD58334
SHA-512:	930CE3938AA02A8BCC609A64BD86B7E6164D63BAAD157A980FD079859A6BEE5DB87BD1F7A74A71108F8368BC9C6154BF14A2DBA1ABF269F572BC262614BCF1DB
Malicious:	false
Preview:	........c#p.e.$...h.,...i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................".....)..........+.....0.....R.....k.............................-.....q.....5...........U.......................8.....v.....l.....).............................b........... ........................................~.....z.....<.............................>.....t.....<...........Q.....{.....g.....'.............................j..........._.................E...........x.............................f...........C...........3.....a.........................................L.....l...........}.............................f.................o...........I...........z.................{...........;..........._...... ....z ..... .....!....O"....."....8#.....#....j$.....$.....$.....%....D&.....&.....&.....'....T(.....(.....).....).....*....t+.....+.....,....S-.....-................./...../.....0.....0....<1.....1.....1.....2.....3.....4

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1094739
Entropy (8bit):	4.273606074036768
Encrypted:	false
SSDEEP:	3072:PAUxhq6CLf6bXs8iQ2Zc2EadKZ0ZfQ0/QeIyTtPukkBBbpUDDM5JiXldW:4K46CjYYZ82IypPubBbf5IlI
MD5:	D43CE80DDCA3FAB513431FA29BE2E60A
SHA1:	3E82282E4ACFEC5F0ACA4672161D2F976F284A0C
SHA-256:	87670FF2CEB1EBC38FCE2C3B745AC965F3DE5DE3133D99ED33933A8F3E99D874
SHA-512:	1D33CA9BACB91EF328F89A14777A704000BF30FE59AA1CBBBFF34D8BAD266C98D78C9E411E289E834E76EB721DD98934426A565CD5B3436D5A103ABE37F7612A
Malicious:	false
Preview:	........^#u.e.....h."...i.3...j.?...k.N...l.Y...n.a...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....\|.....}........................................... .....'.........../.....0.....5.....Z...........................................................h.....................................................Q.................?.....w.....,...........1.....T.....{.....Y...........E.....+...................................+.....Z.....'...........9.....n.....i.....S.................A.....9...........3...................................E.................D.................,.................%.....c.....!.................I...................................b.......................$.....u........................ ..... .....!....."....2#....z#.....$.....$.....$.....%.....%.....&.....'....1'.....(.....(.....)..............L+.....+.....+.....,....^-.....-.....-.........../....L0.....0.....1.....3.....3....14....i5....k6.....7....u7....W8.....9.....9.....9.....:....M;.....;.....;.....<.....=

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	515554
Entropy (8bit):	5.412339344998089
Encrypted:	false
SSDEEP:	12288:KhBp7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJkEydROC:Khh4V8RPS9lMN4MZRg5P56iq
MD5:	2D30C5A004715BC8CD54C2E21C5F7953
SHA1:	FED917145A03D037A32ABAC6EDC48C76A4035993
SHA-256:	D9C45D55A9A5661063B9BBEBB0615DE8F567F3925D04FD10938DA9617C6220E0
SHA-512:	B3803551F53D290D8839789F829AFC9C1E12052C81BA20D5E01FB3D2BACD5D1E97BD4C05074322EED17FDEC04C9176C655076FAEC8A3AEF17C39FB999E0C1FCF
Malicious:	false
Preview:	........e#n.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....K.....d.................G...........C.....b...........7.....~...........,................./.................*.....G.................).....<................. .....1.................].................}.................X.......................t...................................<.....W...........w.................^.......................J.......................(.....y.................(.......................7.......................$.....s.......................H.....t.................8.....l.....}...........o.................5.......................0.....w.................G.....~.................y.................V.......................9.......................C...............................................&.......................t.......................k.......................d.................&.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	530593
Entropy (8bit):	5.852935430786663
Encrypted:	false
SSDEEP:	12288:ljXB+Hdo1ryvJvtQW5EK8VPDNOQ3SCmPs:ljXwHO1uvJ195EK8V5ObCmPs
MD5:	06E3FE72FDC73291E8CF6A44EB68B086
SHA1:	0BB3B3CF839575B2794D7D781A763751FE70D126
SHA-256:	397134D1834F395F1C467A75D84EF2E8545CB0F81E94DBE78B841FBBDAAD802D
SHA-512:	211594C30AD4F5CA8813596B59751168C60DFA0D13F24F2AA608FCE82D21C2DE3DE69FE007C4BDE1602DA8AA7EA81EC0F15E173ABC1224362C36B493B425B425
Malicious:	false
Preview:	........K#..e.....h.....i.....j.....k.....l.*...n.2...o.7...p.D...q.J...r.V...s.g...t.p...v.....w.....y.....z.....\|.....}.....................................................................................1.....F...........t.................R...................................W.....p...........U.......................k.......................Z.......................j.................P.................A...........(.....a.....y...........L.........................................P.................-.............................d.......................E.......................4.......................H.......................C.......................8.......................P.......................\|...........?.....V.............................g.......................m.......................s...........(....._................. .....4.................G.....\...........6.....w.................}.................[...........,.....M...........0.....Z.....o...........%.....J.....^...........8.....r.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	479902
Entropy (8bit):	5.456625778597649
Encrypted:	false
SSDEEP:	6144:+luvzrGLXfBlzV0qV5cU3sVEs7a7wlTwUJwa7obRR2vJub51NrXBDUd4JTGqfwI:+HbzszaoQR5rrBTpz
MD5:	1939FAA4F66E903EAC58F2564EEB910E
SHA1:	BACE65EE6C278D01CCF936E227E403C4DFF2682D
SHA-256:	0B9DA7BD6531A7EBE7D8188B320C0953ADCFBAF654037F8265261A12E63D3C87
SHA-512:	51588D2FE724E6C407724EA6F46883DED39397AF744EFFAF672F75952A6A734E61E93E59F446080317F2A2B3FA1B45E7405F90FE0B226C44C9F3DD9A4E130A87
Malicious:	false
Preview:	........j#i.e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................#.....+.....2.....9.....@.....A.....B.....D.....R.....b.....v.................v.................5...................................U.....q...........A.....q.................4.....[.....h.................F.....T.................L.....f...........R.........................................B...................................T.....n.............................U.......................<.............................n.......................f.......................k......................._.......................>.....d.....n...........'.....T.....b...........].......................s.......................P.....n.................-.....J.....Z...........B.....\|.................k.......................v......................h.................&...................................3.....b.................^.....p.................$.....1..................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	512832
Entropy (8bit):	5.50981730028679
Encrypted:	false
SSDEEP:	6144:Vsu6moWkxlRnY43K7UpHa63gXya/nOdxIHa3AnO1a265QM5GR6mszMRQI2Cga:VsU4e43K7UpxgCaPoCwM5Vmv2Cga
MD5:	2163820CD081FDD711B9230DC9284297
SHA1:	C76CC7B440156E3A59CAA17C704D9D327F9F1886
SHA-256:	6D787033C94755CC80C187ED8A9DE65808BB4D7968354BBB94B7868AC2E8D205
SHA-512:	920FA2A10F7AA7F1F6D911FE2A77EDED0384617D8FD863943AFD99A584DAB3FB2EA3E5D2E20BCA529689A99FDF303912007F2918C62482D8A90194A810F6E535
Malicious:	false
Preview:	.........#..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t...................................<.................)...................................B.....\...........R.........................................>...................................9.....[...........q.................L...................................[.....m...................................C.................(.......................9.......................L.......................{...........E.....\...........J.......................x.................*.......................Y.............................N.................%.......................................................................X.................D................./.....F...........+.....W.....j...........a.................8.............................7.....s.................................../.......................X.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	929418
Entropy (8bit):	4.738354677437668
Encrypted:	false
SSDEEP:	24576:ovf5YcXPdGgx11hxi9c9N+JXDsSYSmqHMuD2fpoLwj3BAVH8+VdQ5tNDQo32Etfd:2f5YcXPdGgx11hxi9c9N+JXDsSYSmqHe
MD5:	A14D8A4499A8B2F2F5908D93E2065BF7
SHA1:	1473A352832D9A71C97A003127E3E78613C72A17
SHA-256:	EB46D9860835B69D33B2583D1E52B20238B666B967BF00906424E3C8A161ED64
SHA-512:	427271D12590F8EA3F11B83E4C0CE79C55C289573C5F6E5C70C789B28A5181F295A3C9B1A4BDD1F731F338E6EDB1E06318EA6410CEAC546128A84FF8F2EC0B40
Malicious:	false
Preview:	........f#m.e....h.2...i.:...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....X.....}.....................................................8.....n.....v.....J...........(.....K...........`...........]...........C.....d.............................................../.....7.....1...................................,.................A.....l.....].....................................................I.................l...........b...........,.................V.....1...........w...........k.....7.......................i.......................s.......................k.......................................... ....^!.....!.....!.....".....#....V#....r#..../$.....$.....%....J%....7&.....&....s'.....'....p(.....)....V)....})....H.....+....h+.....+.....,....5-.....-.....-...../....30.....0...."1....#2.....3....~3.....3.....4.....5....Q6.....6....=7.....8....q8.....8.....9.....:.....;

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	418411
Entropy (8bit):	5.526282387769971
Encrypted:	false
SSDEEP:	6144:A8iCFs0mZ2dXipvrIQoqbh7GMP9eRT/LfaY1+/845prSQBE0RbhU:AJCyeXipvrI7IGMuT/7o5ZSsU
MD5:	9D9121BDC9AF59B5899CE3C5927B55D8
SHA1:	568626A374CD30237C55B72C74B708DA8D065EC1
SHA-256:	F4D45CCC89834376F35D4D83FE5B2D5112B8CC315FCB03228720749AAE31C805
SHA-512:	149A8ACF256DC12F62706F72AD8EC88CBFDF7F8DC874BCD9FACF484CDB00E7C5787F5E1BBC12B5BBE1B19B6524E7E8A1C7DBA2838ABEB9AAFA3CE89795FD22AE
Malicious:	false
Preview:	.........#..e.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....\|.....}.....................................................................................>.....O...........".....i.....\|........... .....Q.....a...........!.....].....s.................G.....\.......................%.....n.......................7.....\|.......................o.......................].......................3.....^.....n.......................9.................D.....X.............................6.....q.............................:.....F................. .....3.............................L.............................Q.....y.......................;.....F.................<.....Q.............................a.............................a.......................5.....j.......................'.....6.....................................................~.................<.................3.....P.......................-.....t.......................C.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	421711
Entropy (8bit):	5.516302021610083
Encrypted:	false
SSDEEP:	6144:MOoiE2KSqdBEuUu6/9meKMP9e7X9ifaY3yzq5J7SKn0F/lOSwH:n5EC2B4bKMwX9cj5hSwSwH
MD5:	626F30CFD9AD7B7C628C6A859E4013BD
SHA1:	02E9A759C745A984B5F39223FAB5BE9B5EC3D5A7
SHA-256:	0FD74BB69AD35B3F9391FA760BF0EB0EE73D2BEA0066244577EF2ABD269513DE
SHA-512:	9CE902F21FEF70C5B5AF444B532B36C9A00D896878CB4021C9B1DC07AA3277D956BCA65EE0ADB68467EEC113E535B60A8A5FB5414C7D0CA761CEAE5C43B7D9A9
Malicious:	false
Preview:	.........#..e.Z...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.............................w.................(.....u.......................u................. .....k.......................@.....i.....w......................7.............................g.......................Y.......................5.....\|.......................K.....w.................K.............................2.....A.............................%.....b.......................7.....i.....\|.................@.....L.............................V.............................[.......................J............................M.....c.............................m.......................=.......................$.....[.....v.................$.....N.....^.................;.....S...........$.....m.....{...........7.....n.................-.....Y.....h.............................z.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	508230
Entropy (8bit):	5.385230992997236
Encrypted:	false
SSDEEP:	3072:iEsyQDjcRy2VdU1P2BCA6bKVjnE4rHOniSb8p5Yl+lblmwoab5uIay5LlZi+SLFv:iEsyQvt2ECiOX3p5YWm85wLFaoImYA
MD5:	6F4613A4A88AF6C8BD4EF39EDEEE3747
SHA1:	C8850A276D390DF234258D8DE8C6DF79240C8669
SHA-256:	8F7B8776E61E3ED5AA33B1A571AC834653B54B12A499D956B95D567B7E1BA987
SHA-512:	E5933DCB2AAAA2018BA8B13F4AF3DC8A950640AC60ACB1B56AD6DE24541701D0FFC1F4CB28C7932AF924BFD673EDCEE20BF649156AB95EA9499EC43C703EA141
Malicious:	false
Preview:	........q#b.e.@...h.H...i.Q...j.]...k.l...l.w...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................!.....).....1.....8.....?.....F.....G.....H.....J.....\.....k.................*.................9.................V.....n...........~.................u...........,.....G.......................'.........................................]...................................e.................).................<.....S...........?.................:.................9.............................p.......................g...................................2.....E.................G.....S.................0.....;.........................................,.....<.........../.....{.................V.......................X.................I.........................................t.......................j...................................).....C...........X.................c...........".....P...........6.....z.................'.....J.....]...........N.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	507855
Entropy (8bit):	5.361522715042697
Encrypted:	false
SSDEEP:	6144:NPKK+SmGmQaXDFY1+hM03GgDE7pF+E8y1l4Fj05fYrK3osSl6PZjHu:ZKKDmXXDdq01ap4y1lEj05Qr0osTO
MD5:	A24E01A4947D22CE1A6ACA34B6F2A649
SHA1:	750C2550465C7D0D7D1D63AD045B811B4A26DC55
SHA-256:	848D422BE1B8FAE74786ED6D6DFA7DD2E97B798B4A9BA1D929085E425B2A54E0
SHA-512:	02FC4CE96AA523EBC204243BBEC3347B09CB20BCC0BA66CF9532A6FB26C48F7F2396BBB833F1916F8F081FFC9C6CD2DE07315E66C5115042A0B44270FA4468C1
Malicious:	false
Preview:	........q#b.e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....\.....l................./...........'.....B...........$.....j...............................................9.....T.................>.....N.................8.....I...........C.................7.......................{...........).....:.................F.....[...........O.................G.................0.....................................................v................. .......................2.......................'.....{.......................b.......................Y.......................h...........$.....>................. .....=.......................4.................@.....S...........H.................-.....y.................!.....w.................7.......................}...........a.....x.............................w...........!.....5.............................\|...........$.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	460480
Entropy (8bit):	5.4631405749616855
Encrypted:	false
SSDEEP:	6144:2Ve10hVbtjvP4cCJ1ONRCOeP+sEmThFC0jmFohH4fSpY0lgtim0DM5Oju43sPZCo:+eQtjvP4cnre/tHmFoh99M5Oj+x
MD5:	82A07B154CB241A2EBE83B0D919C89E9
SHA1:	F7ECE3A3DA2DFB8886E334419E438681BFCE36CF
SHA-256:	84866CCAF2EC39486F78E22886BEF3FE75C1EB36E7A7C071471040E12018DB28
SHA-512:	07319D155BDF9E27762ECB9EF6871430BEF88B1AF129450EB65AA798EBAA4E02B25B0CF9BDE3B12FF1B04A3D14241569B73D6AF895D2E85DD7B24D393E7317E9
Malicious:	false
Preview:	.........#T.e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....~.......................9...........0.....K.................J.....]...........?.....\|.................[.......................S.......................B.....m.................A.....j.................f.........................................!.......................1.......................^...........!.....8.......................:.............................e.......................].......................i.................#.....s.......................j.......................j...................................5.....M.......................0.......................5.......................'.................#.....O...............................................!.................%.....@...........;.................)...................................&.....3.............................e.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	756165
Entropy (8bit):	5.0211117057378845
Encrypted:	false
SSDEEP:	12288:DCD38/+r28u313uyqoe+slXcfqEdvRmXzoT4WmdAQifaQ2XxFHGk62BtMX9OxRdn:DCDo+r28u313uyqoe+seqIvRmXzoT4Ws
MD5:	C770CFB9FBABDA049EB2D87275071B54
SHA1:	20E41B1802C82D15D41FADAF3DCD049B57891131
SHA-256:	DAE7E7C87026CD4E8A4CD813CC71DEF32C86ED47865CE6DA5383B66B7021C5BC
SHA-512:	CDA117A60C853F12ADE579C34FCE22D992B33DF1F5001A237767B6E642D5C775C3387BCEE05D6557FE5A2F6235F93258954A697D3B9812D2550C4801869F4751
Malicious:	false
Preview:	........##..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...\|.`...}.r.....z.............................................................................:.................q...........D...........[.....}.....E.......................o.......................G...........9.....L...................................%.....g...........P...........E.....m...................................L.................o...../.......................\.................{...........7.....[...........c.................9.................&...........^.................S...........3.....J...........V................................... ...........F.................F...........R.....u...........z.................t...........Y...........).................6.......................!.................<.....W......................./...........b........................ ....m!.....!....P"....."....R#.....#....=$.....$....3%....V%.....%....T&.....&.....&....J'.....'....6(....^(

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	470482
Entropy (8bit):	5.425789814492222
Encrypted:	false
SSDEEP:	6144:K+2JevEiMD19i//8e36bwFh20RtrZs6TIOEysaI9LL59YWyHrE5WacpoPWmMWO4C:K+9Hs19S/rKJam59YdHrE5WaipKYn
MD5:	FE011231BBC8B3A74652F6A38F85BC88
SHA1:	2B851E46738D466B3A5A470DE114D15051B6EB6B
SHA-256:	7A3249514585491EB47FE4B579EDC27CCC48761E7AD6BC11D113B257132C5DD2
SHA-512:	2A4E5C1409347B4B514556C81EF32C8AE118ADD28E3469717B13045C8424FED9B817C7988629050ED3E732E0CDCA181891B6A8B9E64E4C8D65F004D7C8DB9796
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}.................................................................o...........B.....U.................N.....a...........>.....x.................b.......................W.......................(.....H.....X.................*.....D...........'.....i.................5.....a.....w...........7.....f.....{...........8.....i.................q.................).....\|.......................O.....r.......................4.....@.............................o.......................T.......................0.............................f.......................y.................&.....k.......................K.....m.................I.....m.....\|...........H.......................1.....H.....W.................8.....J.................?.....Y...........\.................-.......................=.............................Z.....s.................7.....b.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	531993
Entropy (8bit):	5.200104622437094
Encrypted:	false
SSDEEP:	6144:VJPfDjGZPitD/ty3DQZIbpiWFevNnGFZ338mC5oVms68ARrq8:VhGAodn7C5Sm7
MD5:	7354DE570C8132723C8E57C4CCB4E7C4
SHA1:	177780FAF460E3C8A643A4D71C7A4621345A8715
SHA-256:	91149190C856195FB330605686ACF09C7197E5B7EFE37FE2A7C76BB8FB08CC89
SHA-512:	A8487A6A7FD46D62E78CA4262DE49E12C120268561EE61A642C45EFA48116EDEBEB40CF9E8BE229DB0BBF06BB6B5457CC54399A08EE6A603E5540EF5CA482798
Malicious:	false
Preview:	.........#..e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................%.....&.....'.....,.....9.....N.....d........................................!.....f...........#.................7...........,.....p.................P.......................c.................:.............................0.....~...................................n.................4.........../.....y...........(.................6................. .....=....................... .....u.......................z...........%.....;.................=.....L.................A.....O.................A.....O.................D.....R...........S.................$.............................p.......................m.................7.................'.......................2.................C.....^...........R.................[...........^.....t.............................{.................4.................................. .....\.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	550280
Entropy (8bit):	5.387288883804832
Encrypted:	false
SSDEEP:	12288:V06pImfHXFZLiQphDDq6QuaMV5wKzvOtXDZ/MYnYtgLXfyzEi5Qx0JSWkv40wCns:VNfqsVaC5WK
MD5:	D8B4BC789A0C865FB0981611FB5DCDBC
SHA1:	33F9F03117F0BBA56A696F2FA089BA893EE951A2
SHA-256:	52AA0A18ACE6347B06A89E3851A1B116812C022DBE41DA8942278878B5409CEE
SHA-512:	58D19E5A3C68C901FA2A0C327A45B410AB9B9E6C39298DB48EED25345453DCE1A4633AFE6277CF53ED558E160065B89C0E38A32CAECED47E79783DBDA4D74F26
Malicious:	false
Preview:	........S#..e.....h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...q.c...r.o...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................&.....4.....F.....U.......................<...........#.....c.....{.........................................;.....d.................D.....T...........(.....c.....x...........m................._.................0.................M....._...........7.....t.................r.................a...........M.....m...........2.....c.....z...........,.....V.....h...........2.....h.....z...........J.......................a.......................\.......................I.....u.................H.....z...................................p.......................b.......................O...................................g.................J.....g.....}...........i.................H...................................m.................r.................j...........6.....O.................+.....?...........+.....p.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1074089
Entropy (8bit):	4.312676397057413
Encrypted:	false
SSDEEP:	3072:QIEt+9TXuSm4vSDnlrjqy5HIwjAwREJKVMjNiT7llj63rFWlPvpMi5eQWiYJ+WRc:QIEtYXuLUKlrjTa4/WP5c4h6vFX
MD5:	225167DBDF1D16B3FAFC506EB63F6D1D
SHA1:	8651B77F41E3C5B019CCB124A7C8F6449A04B96C
SHA-256:	FF379DD77136B9B85E7E9FCB5B261ACE9C6D9184AF3BA2DEA35B1757B9BAB6D9
SHA-512:	A353D36A87B6608578816056647DE45A456F9012D399B2CB5CB7B9DE867A370FCAF1A90D293F367B9B678D13991294425ABD85CF77E971AFA0D3E9C316952115
Malicious:	false
Preview:	........h#k.e.....h.6...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n.......................2...../...........<...../...........s.......................j.................1.............................b...........B...........,.....L...../...........J.......................&.....h.....>.............................e.................................................................k...........@.....g..... .................=...................................m.......................v.......................M.................a...........h...........:...........E.....d.....w...........,.....b...... ..... ...."!....K!.....!....P"....\|"....."....Q#....2$.....$.....$.....%.....&....D'.....'....i(.....)....L)....~)....a*....'+.....+.....+.....,....t-..........6.....]/.....0....X1....y1.....2....y3.....4....`4....L5.....6.....6.....6.....7....C8.....8.....8.....9.....:....n;

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	661497
Entropy (8bit):	4.632075612159233
Encrypted:	false
SSDEEP:	12288:9xsskchOxS28YeqhCdrNGmnSWqo/IQXOl60pACDXbheQCap125nVwo9Ps5plm7oM:9Bk7g5Wof
MD5:	D8320B09C1E138B00655DB0802687BCA
SHA1:	01616BDA6B22C70D5C6440B7451AE736EB1336CB
SHA-256:	E3336668AAD9AD661E7F589F1A405B9C95FC771261CDF9328ACA88F4BE763374
SHA-512:	5A91596D7E82DC3D692083AE45AFF6FDBDDD08CA17F49A020E0769F98C4218B6C9CD31E54524473B7CDCCBEBF4D7A7F0FF23B5075A1E1ADA5CC35C3FD0172BED
Malicious:	false
Preview:	........D#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................(.....A.....^.....#...........b.........................................3.................8.................).................g.....x...........[.................;.............................*.....\|...........:.................8.........../.....u.........................................S.................j.................).................E.....X...........t.................^.................#.................Z.....o...........U.........................................V.............................<.................-.......................]...................................O.....n.............................v.........................................4...........I.......................I.............................[...........;................./.................K.....o.....$.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1128743
Entropy (8bit):	4.289393956482131
Encrypted:	false
SSDEEP:	3072:CaaJyCmCd3RTaIEDOGV/BB0ZV1dsuOlRLXW3XHij0TByntDPtDlSp1s4u/8WLw3k:aQDa3RTaISOOz5j5thGM
MD5:	9E1788B0F3E330BAF2B9356A6C853B20
SHA1:	A2F4B37A418669E2B90159C8F835F840026128D9
SHA-256:	C640313E10E985A58D16F928D2428AE278421A070D948733AC68FDF7312090FD
SHA-512:	B9A577E084F8DAEB53FAD0A9423661C99CAB272125899A16B0B052606A2CB88F823137F3A21B5C06B10E0235321B7FACA84CD759BF406FB2DD02C2F598E92CB5
Malicious:	false
Preview:	........0#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.)...s.:...t.C...v.X...w.e...y.k...z.z...\|.....}.....................................................................................B.....{................._.................}...........B.....p...................................&.....U.....(...........6.....f.......................<.....#...........&.....c...........l...........$.......................W.....>...........l.......................$.....V.................S...........g...........m...........Q...........U.....................................................3.......................#...................................B.................j.....".....\|......................., ....\ .....!.....!....."....<"....."....X#.....#.....#....p$.....%.....%.....%.....&....a'.....'....;(.....(.....).....).....).....*.....+....[,.....,.....-....A............/....x0.....1.....2.....2.....3.....4....+5....m5.....6.....7.....8....t8....h9....&:.....:.....:.....;.....<....$=

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	512611
Entropy (8bit):	5.519796392618245
Encrypted:	false
SSDEEP:	3072:3byA6gCM6By7Nv7vr7hA8aBV08Iouo+wvxr0Xcp/AikOSAqb+HicHE0uP1P4NUFn:Ahwxfh+cwJPwd75or76l/4c
MD5:	AF7AEC4B45EAD620463B732E16F63E47
SHA1:	E6838C56B945C936FDB87389FDC80CDF7BC73872
SHA-256:	BFEEAFE2F8A9F797D20C4209181C4768FBEA4A61FF2DC1F57F6CD18BC872FC13
SHA-512:	784FF8DC6011883E931B4B8371E5ADA960120931BFDF24F81648F5092FA31DB1D03E5D3CF5CD16D57EA7FB7877BB25A28533085AB42BFE40DC25CA7D9CEE7ADE
Malicious:	false
Preview:	.........#T.e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....z.......................E...........3.....T........... .....X.....m...........d.................?.......................S.......................G.......................F...................................K.....m...........9.....}.................Y.....................................................s.................D.....k.......................@.....Q.............................u.................#.....y.......................x.................'.....y.......................].......................m...........-.....H.......................'.............................c.......................w.................P................. .....6.................5.....N.........../.................'...................................:.....^...........!.....P.....a.........................................H.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	551843
Entropy (8bit):	5.644800761543747
Encrypted:	false
SSDEEP:	6144:0sTpI7ceE8WnOL42HPs2P0Ar7ky1XB5VwFZfpadYGDuU1gGse33a5gRFxztGateg:0spI7Y8WQ+AXB5VwAtj/3a5t+D
MD5:	B93BEEB1E35A29B310500FA59983F751
SHA1:	45C0B2CAB4C4A820CFC2AED4B7236DDC79A0DB00
SHA-256:	BAB09C3CB80130A4A288642633C2B31AB08B1757466D9A468BC36D276079F002
SHA-512:	249DE5B8BD7C4755CAA8B9552254D353B0D885B63BD5F7C6C8E29B3F4E447C9E8D6C0E88D5AABA0B898AA26880592B3904E19CA4797A2AC1DD757AAEE782C37C
Malicious:	false
Preview:	........E#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................!.....6.....J.......................7.................v...............................................8.....Q...........+.....R.....c...........9.....r.........................................).........................................K...................................`.....z.........................................:.....W.........../.....V.....n...........F.....q...............................................U.....k...........v.................-...................................X.....l.............................M.......................t.................)................./.....G...........C................./.......................%.....~.................R.................(...........V.................\|...........L...................................b...................................Q.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	454027
Entropy (8bit):	5.384059218448116
Encrypted:	false
SSDEEP:	6144:f91C6s7szabK6s1o8Jf+eVnjHF26miZ0FZ58VhrwkK5R3SzP7IEji40Hf:fu7Bu6F85VnjHFXmM0b58VhAf
MD5:	BC719B483F20E9A0B4B88969941C869D
SHA1:	4D926A9ABA7C350E9DA8AA570A9F52534C81AA88
SHA-256:	F175E58BE47B228803AA32D2695E2FCFAF4655B65B96FB6B539B3E59593E6799
SHA-512:	DDF6108888676C1A90865DAAA88198B681B685D9047B0E10F5AA08DAA39A628A84732A8518606176529297BEC51CE8BC39E910EEFFC8B88E9585FAFB694C35DB
Malicious:	false
Preview:	........[#x.e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................".....#.....$.....&.....4.....A.....Q.....c...........I.......................J.....w.................J.......................d......................._.......................0.....Q.....h...........'.....V.....z...........2.....d.....{.................H.....U......................7.................8.....K...........&.....k............................./.....{.......................A.............................m.......................R............................V.....`.................0.....<.......................).......................%.....m.......................(.....h.......................F.....q.................*.....[.....}.......................)...............................................)...........!.....z.................S.......................Z.......................!.....@.....P.................F.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	501266
Entropy (8bit):	5.293951985847116
Encrypted:	false
SSDEEP:	6144:ZckXLmyax92+fMiMNDYISIqRRRsO1StBWRT9Tjex6qipELqbPpzHi9fLwsQ2nbwb:iWmhH6mZD28HG4KUw05klot
MD5:	AB160B6E8BBABA8F8BDE7E2D996F4F2E
SHA1:	EB7EAE28A693337B8504E3E6363087B3B113BC72
SHA-256:	E86BA661B3F6F7ECD2312FE90B873330C0D6516A5501A0F326875844E8D4B289
SHA-512:	14E8919E2F5A7AD2B3F310FFEC590B221E6E0DC45F37EFC57FF9B8FF7A3CA674D6F4B9BD65E49A98AF6726FA953F2168E5C8E6101ED977E8C7FF4A51203F8D4D
Malicious:	false
Preview:	........a#r.e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....E.....T.....m.....~.........................................&.....7.........../.................?.......................l.......................;.......................>...................................S.....x...........G.......................^.................".......................l...........3.....Q.................+.....I.............................e.......................H.......................P.......................0.....~.......................R............................._.....j...........Q.......................[.............................,.....B.......................1.................T.................2.....X.....m.................3.....F...........+.....~...........3...........#.....:...........4.................+.......................F.......................(.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	613077
Entropy (8bit):	5.6866751137991765
Encrypted:	false
SSDEEP:	6144:a1AxTSuPJmsKRC/uGsDKNJL+iCrtZKQ2xM6bU5B7YxVD:a2xYsKRC2GsDa9StZKQ2xM75B7m
MD5:	DEE9626A8D7CACC7E29CFF65A6F4D9C3
SHA1:	5C960312F873AB7002ED1CCE4AFDB5E36621A3CE
SHA-256:	63AD3974BAA8C160BA30448171F148D008AC19E80010FB13D3A65CF411B67AE0
SHA-512:	EE80D58886F4AC378D6491E075062C171A715AF7C42DD1785952B25A572381ACD722764E8BE914ADBFCCF2A5FA4A51968B989B632EEFB9D636851F1B8FFB82E1
Malicious:	false
Preview:	........."'.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w...................................................................................;...........a.................P.............................G.................{.....&.................;.......................\...................................3.....X...........g.................?......................._.......................}...........%.....4...........{.................b...................................>.....Y...........l.................{...........g...................................j...........*.....<...........'.....c.....r...........}.............................o...................................a...................................\.....z.............................q...................................<.....W...........,.....f.....\|.....$...........,.....A...........Z.................b...........!.....B...........0.....i...............................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1231605
Entropy (8bit):	4.220671500631487
Encrypted:	false
SSDEEP:	12288:UNHCRmR6fkA6GjYQnbY25l67c5qBUic+E+htyR:UNiRmR6Lr5mUJ
MD5:	32E5F528C6CEE9DE5B76957735AE3563
SHA1:	74A86191762739D7184B08D27F716CFA30823A98
SHA-256:	CD297F7E872B34E63CA2D98DC2FA79085E8A2985BA8757601E4B901A3F30B013
SHA-512:	92D100B1289E63FD0DC65657FB4B1E16F298735E6CD066E9122D04E3B79E0D286F15FC9F1DA2C3A05AF528B92BDE95FCFBC493C466DB2D94A0749ADFBF7FB8D5
Malicious:	false
Preview:	.........#O.e.f...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...\|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....{.................).....u...........(.....)...................................@.....Z.....4.................T...........1.........................................E.....t...........i...........\.........................................r.......................-.....j.............................V...........q...........x...........G.....y.....8.................0...........s...................................;.................D.....f...... ..... ....>!....m!....B"....."....s#.....#....i$.... %.....%.....%.....&.....'.....(.....(.....)....j.........)+.....+....L,.....,.....,.....-....+..................0.....0....v1.....1.....2....y3.....3....(4....X5....$6.....6.....7....X8.....9.....9..../:.....;.....=.....>....I>.....?.....@....\|A.....A.....C.....D.....D.....E.....E.....F.....F...."G....UH....>I.....I

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	517250
Entropy (8bit):	6.059093259094021
Encrypted:	false
SSDEEP:	12288:Bv+8Jr3zNRTuTjXcq+t8OQ4EVh3IKACqX5K7GGZ+8BtPq7hUomrOedlO:x+8BWm5H86alO
MD5:	38A95D783D627E9A83AD636FAA33C518
SHA1:	CB57E8E9EF30EB2B0E47453D5EC4F29CEA872710
SHA-256:	0D9B23E2981412D11ECEA3ADE8D521A073802D9431C39D72B88F62B98E50A96B
SHA-512:	4119B8F82107473C941C9E10B6BAE97D60C9C47570CC2B40F429A95F4F5CCA77EECBACD7023AF439429026F6E55AD9DF19998C8B98BE0D04D384B310D025C0DC
Malicious:	false
Preview:	........."A.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.....z. ...\|.&...}.8.....@.....E.....M.....X.....`.....o.....t.....{...............................................K.................#.................=.....P...........4.....z.................^.......................r.......................v.................).......................:.......................S.......................G.......................F.......................\|...........?.....V.................,.....C.............................v.......................v.................7................./.....?.................:.....M.................9.....I.................8.....H...........=.......................H.....i.................C.....k.................N.....t.................z.................8.....u.......................V.......................J.....}...................................[.......................\|.......................q.......................f.......................}.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	556374
Entropy (8bit):	5.6329747097065646
Encrypted:	false
SSDEEP:	12288:ciW9XReMAg80mI963AS56ziarWCB56SNU:xAAMVL7S5Xa6CBW
MD5:	3E9119A712530A825BCA226EC54DBA45
SHA1:	10F1B6BF2FA3A1B5AF894D51B4EB47296C0DBC36
SHA-256:	3DA531A9A5870315823E74B23031CB81379D2D94AE9894A7FB1D8A8AD51A2DA9
SHA-512:	765C872CAFA1B266575B0CAC09DFA796CDB860BD82E1C657397FE2AADA11771F306B0A1776E4D66FF41E94B153C812592430F31E7B1FF97ABE7D8E6B96D321F1
Malicious:	false
Preview:	........j#i.e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................#.....+.....2.....9.....@.....A.....B.....D.....R....._.....s.............................#...........9.................3.................'.................V.....p...........i.................'.......................z...........(.....M...........`.................8.......................m...........!.....1...........I.................:.................6.................?.....Z...........=.....m.................k.................+.......................p...........*.....9...........7.....r...................................9.............................(.....{...................................Z.................?...........1.....g...................................o.............................4.....v...........'.............................W.................J.................,...........^.......................u...............................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	553985
Entropy (8bit):	5.628621633625195
Encrypted:	false
SSDEEP:	6144:E4wNRkfYqooJw9bJ28DZyJxyNGtVF2tPlz7c4YbUSZbb3n5nygN9E9J5gosRyEAS:Okxw5P8iplzw4XkXn5vE350ypO19
MD5:	E75CDDA386DD3131E4CFFB13883CDA5F
SHA1:	20E084CB324E03FD0540FFF493B7ECC5624087E9
SHA-256:	AE782F1E53201079CA555BAA5EC04B163188E5161242D185F04A606A49FC8C0D
SHA-512:	D27BC61028031946ED6708918F921C3D681C8962B8D5507A91AB6576E3B2C462524E550305DB87EDE886E41FB0E49EDEC2D84CDBBAD675282105627E01D98BF5
Malicious:	false
Preview:	.........#C.e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................D.................1.............................D.................0................. .....{...........;.....F...........;.....s.................u.................f...........^...................................A.............................>.................,...........".....C.................4.....J.................@.....R...........%.....L.....`...........q.................1.......................\.................(.................D.....U...........M.................*.................5.......................(...........'.....^.....~...........M.....r...................................{................."...........&.....[.....t...........r.................l.....$.................".......................v...........8.....H.................5.....W...........n.......

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1281970
Entropy (8bit):	4.255584378467937
Encrypted:	false
SSDEEP:	12288:+okD5/VA2cMmsbbAxqInxblD/xn9mMRTAr6DuhQA+tHxy3ewh+5qR7dCds/fv38C:aPzqzXry3e75qR7qs/X3X
MD5:	6E96EDDFE80DA6AAA87F677FEEF4D1D6
SHA1:	8A998785D56BC32B15CEE97B172CD2DCDC8508D9
SHA-256:	E2FB73353AB05EB78F9845BDBDF50B64C9FB776B7F08948F976FE64E683397C4
SHA-512:	FEEA11DFC6EC153AB903B5828306617EEDEEE19DAA73BD046AE47757795FECB9ABCE6192BB3A9561AAACE7FC85EE442057B93081C6C986855B819FD38815E6F7
Malicious:	false
Preview:	.........#M.e.j...h.r...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.......................<.................2...........e................./.....{...........J.....9.......................U...........v.....F.............................a.................[...........!.....o...........E.......................D.............................Q.................\...........6.....~.....u.................B.......................T.......................n...................................b.....F ..... ....]!.....!....u"....F#.....#.....#.....$.....%..../&....l&....;'.....(....q(.....(.....).....*.....+.....+.....,....}-.....-....1............/...../....,0.....1.....1....n2.....2.....3.....4....p5.....5.....6.....7.....7....28....T9....K:.....:....,;....k<....-=.....=....+>....Y?.....@....QA....zA.....B.....C....tD.....D.....F.....G.....G.....G.....H.....I....=J....wJ.....K.....L.....M

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1052914
Entropy (8bit):	4.286050307210063
Encrypted:	false
SSDEEP:	3072:3P5UK/LY0rHXWjViQm0vLJuVXrMHwrNf3FaMUCyGR93RkR3bntOubz1hzudmHwfZ:xUCY8qA0pJvC3SGINa5/pC7t2
MD5:	FDA40999C6A1B435A1490F5EDCA57CCD
SHA1:	41103B2182281DF2E7C04A3FFF23EC6A416D6AA9
SHA-256:	0EBB125A0BDFD1E21B79914CA8E279790D41F7BAC35BF2D031DD7981F1C1C056
SHA-512:	666CEB24D2E568A00A77512295E224A6545BF6ABCFA19C93AA823DB5330117FCB39FDE570E7601DBD41976950C3EC03634F89FC5D9203357515E6651AB0B6D32
Malicious:	false
Preview:	........<#..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}...............................................................................8.....W.................3...........-.....j........... .....a...........................................................f.........................................&...........u...........>.....u.....E.......................V.......................9.....t.................\|...........(.....b.....5...........q.....?.......................Z.................r..... .....a...........y.....V.............................%.....Q...... ..... ....9!....\!....."....."....5#....U#....($.....$....O%....u%.....&.....'.....(.....(.....)....X..........*....i+.....,....B,....d,....0-.....-....o............/.....0....W1.....1.....2....\|3.....3.....4....K5....D6.....6.....7....^8....%9.....9.....:....e;.....<.....=.....=....#?....-@.....@....;A....DB...."C.....C.....C.....D....cE.....E.....E.....G.....G.....H

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	476479
Entropy (8bit):	5.251439262040867
Encrypted:	false
SSDEEP:	6144:B304QirwGezQZU+JsxJwCuRlO0jlsUcSP5slGKsMSYlEFh:O49UzKU9xJqlOulj5VhMM
MD5:	73096184D7BD6A9A2A27202D30A3CFA1
SHA1:	EA711B29787AA8B9E9AF6BDE5B74103429E5855F
SHA-256:	D1072514BAB63AF5DFBF923175D491787139F0C1B6361ACB23E67543836C84BA
SHA-512:	E3FBEE4896554E502C222B5FFE38E9D61E9DB4D18CDC92CE5118B819DC60789BFD6D6C7F8444FF1763222455AB91E79BFE500E75C0E06B0DE70C2C64FB043C6F
Malicious:	false
Preview:	.........#A.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...\|.;...}.M.....U.....Z.....b.....j.....r.....y...........................................................q...........C....._.................R.....b...........@.......................n.................!.....u.......................i.......................n.................=.......................^.......................;.......................).......................F.................%.....m.......................2.............................\.......................V.......................^.......................T.......................B.....r.....{...........5.....h.....s...........V.......................W.....\|.................7.....[.....u.................C.....T.................8.....[.............................p........................................./...........&.....z.................W.......................d.......................4.....V.....f.................A.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	463564
Entropy (8bit):	5.426692701465118
Encrypted:	false
SSDEEP:	12288:8ba9K5cV3MpYuwOp7fdBia+c5Io42gz4vj:oa3D/a+c5z4hzE
MD5:	28CC86C7204B14D080F661A388E7F2C0
SHA1:	E0927EA3C4FD6875DAFD7946AFFB74AD2DB400F5
SHA-256:	9253122D94CCEA904FB9363B8178CA9335B8380B7891F1A7A22AFB3113309E72
SHA-512:	E2524E10D145F95C028D65E47CF06FC82C7A43FCF0ECF01202278C7FB14079C03E9434E8039FD96AAEE870872C9896D9F0ED575E50C19A3781CB0C94FE59B3A5
Malicious:	false
Preview:	........r#a.e.B...h.J...i.a...j.m...k.\|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z.....e.....t.................6...........).....>.................@.....S...........b.................3.......................4.......................".....~.................#.......................O.............................$.....q.................j.................:.............................9.......................D.....].....k.................>.....N.................!.....1.................0.....D.................2.....B.................<.....L.................(.....8.................$.....2.................a.....y...........*.....P.....c.................-.....F.......................'.................S.................>.....d.....}...........J.....v.................Q.......................}.................[...........!.....J.................>.....Q...........................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	477660
Entropy (8bit):	5.368696736425329
Encrypted:	false
SSDEEP:	6144:uerc6TeVRbZy3gihngHh9gog5HHnpo+h459tmxDGpF97358OTn:uf6Teuagog5nx459tmxDGpF97WOTn
MD5:	7FC6AE561FD7C39FF8BA67F3DBAA6481
SHA1:	2E3977403A204C6F0CA9A6856BB1734490A57E72
SHA-256:	844031E1DE2B2872D12D5B7D42ADF633C9D4B48169B1B33B7492B3B060C73558
SHA-512:	90294AE24B7DB003BC34A48F98D9E1887E87C6F605DEFE01DDCF9187429E8446C04A7F94BB6AADC8E61C98842163BC3702B414393AB836EB0BEE038F09481C2B
Malicious:	false
Preview:	........X#{.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w.....y.....z.....\|.....}................................................................... .....,.....<.....M....._...........i.................<.......................`...................................1.....H.......................+...............................................=.................L.....l...........*....._.....n...........9.....p.................e.................@.......................k.......................=.............................b.......................a.......................Z.......................:.....d.....n.................E.....R.................B.....Q...........-.....m.................<.....i.................".....C.....Z.................8.....J.................S.................!.....?.....S.................I.....Z...........,.....o...................................\|...........).....N.................J....._.................&.....6.................&.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	534366
Entropy (8bit):	5.77011996675953
Encrypted:	false
SSDEEP:	12288:Hg1L9OZWoOB/oZU/FmXgvh6HA7b0mPeCUdVe3mbUbEmw1QhWRH5EdL4ftiJ:Al9OjtU01Qhc55y
MD5:	BA7A9ABA68211D8639DFFAE0EF8B88DA
SHA1:	A9A26B8F0902475CB576967CBE9013028CB21DA4
SHA-256:	60AA08598A81BB46DDC64A5AB0852565554C6E6262E9C5DFEE09F4E3FC08D5FE
SHA-512:	A1B8BFC3E19AA1267E31838E1C1F2B0B1CFCDF56F84E967088D626B58EC64B3305043A14B12FD080498EE1D74A4192453914C393CE8F848EA5616CF88ABC4EB5
Malicious:	false
Preview:	........x#[.e.N...h.V...i.g...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....m.....{.................D...........?.....[...........).....c.....v.............................U.......................m.......................f.........................................C...........9.......................v.................,.......................X.................8...........I.................%.....b.....w.................1.....T.....d.......................&.................(.....<.................*.....<.................".....2.............................x...................................Q.....i................. .....7.......................'.......................,.................M.....~.................5.....L.................%.....A.................i.................v.................c.................>.................%.....6.....~.......................b.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	502496
Entropy (8bit):	5.42724876798731
Encrypted:	false
SSDEEP:	6144:OrUbPq56NTyytNBXBLilIyMyE15aKJutiOsRhkxCp:Or6C5FyT5hJKsRKxM
MD5:	53D5FB849C9BAB70878B3E01BFFAD65A
SHA1:	E72AF1A76539E66CEF4A4EEF5844B067A4E1A79F
SHA-256:	40DD24C5E225ED941BBAAB3DCFEFA993E39FBC75A1798F4F6E06424956698AC5
SHA-512:	55357643D789D2EED72E009F08F72BA4895BA455CA00C8347A3C3790E43F8D7E4625FEDA438ECAC840BDC52C26D2135D89BEA693B61A293922B6056BDE6B4516
Malicious:	false
Preview:	........t#_.e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....[.....m.....}.................B...........*.....F.................F.....V...........s.................U.......................W.......................<.......................h.................H...........=.........................................=.......................k...........).....B...........N......................._.......................O.......................L.......................U.......................N.......................-.....[.....e.................5.....?.................4.....E...........@.......................H.....l.......................?.......................3...........,.....g.................5.....N.................N.....a...........1.....\|...............................................Y.................6.....^.....q.................4.....I...........!.....^.....~.......

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	503874
Entropy (8bit):	5.406123541333513
Encrypted:	false
SSDEEP:	6144:f3O/2bF2ozwfieJVJJxhoN4lCOfVY35NKimSRri:f+/2x2od35NKtSR2
MD5:	0237374730FA1A92DEC60C206D7DF283
SHA1:	62DBBD855D83EF982A15C647B5608DAFB748745A
SHA-256:	2FB2FD2E32B952DCBC8914F9D3AAF02BF2750B72ABFEE2E8B2BB08062DDD9934
SHA-512:	63EC4EC44002724E22703A3BD952D1FF4062B367C4F5E3F106349BD226AD1317BEF2E371FDA0E099EA5C0AFD32A9D2C1246C93C18D73DCCF8FC2C1644A6FB6B2
Malicious:	false
Preview:	.........#M.e.j...h.r...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z...................................W...........<.....W...........".....m...............................................5.....Y.................&.....6.........................................L.....z...........Z.................*.......................I.......................f.................0...........&.......................R.......................@.....q.................C.......................S.......................T.......................7.....d.....n.................=.....G.................2.....C...........!.....q.................1.....[.....w.......................!.......................,.................R.......................E.....W.................;.....P................._.....y.............................r...........).....M...........0.....p.................$.....I.....^...........,.....h.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	522785
Entropy (8bit):	5.459461998642662
Encrypted:	false
SSDEEP:	6144:F5F0NqPzpwXg7XTLb/7FSmo/xOfinKdoGN5PBoC1s2e/m7O3:SI0g7XTL/FSmo5OqKdN5pop/53
MD5:	4E692489E2AE74A4A11CA0A113048F15
SHA1:	CB2B80217D5372242D656AC015C024FE1E5E77B7
SHA-256:	4A2A305668F1926CFE4BB72E8FBFDE747C83AC4DD9CF535C13AE642D0B96FB79
SHA-512:	8AD9E0A79137A862DEF24D6963536E75B87BB71AB74DBDD43531C5C95DDD3CD834F22C6A8E3A1E03AAD35ADE65ECD227D5101B5BE3CE3F0B7B471F5136CFD77C
Malicious:	false
Preview:	........j#i.e.2...h.:...i.K...j.U...k.d...l.o...n.w...o.\|...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....Q.....].....k.....}.............................l...................................p.................x.................-............................._.......................}.................j.................>.................d.....}...........@.....t................._.................L.................J.......................$.....s.......................D.......................).......................&.....{.......................c.......................9....._.....o...........!.....P.....d...........\.......................c.......................3.....S.....w...........8.....g.....z...........k.................B.......................3.......................^...................................U.....n..........._.................B.......................F.......................H.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	856355
Entropy (8bit):	4.826212670448168
Encrypted:	false
SSDEEP:	12288:2oZ3aknfQjRo4YS7yMh/KgNzJ9fx+aAka2qSGsN8zqcnYH8eXN2hPO3j/zpbzvMX:hZ3GR/5X6Eq
MD5:	1A9B38EC75CCFA3214BEF411A1AE0502
SHA1:	DE81AF03FFF427DFC5FFE548F27ED02ACAE3402D
SHA-256:	533F9E4AF2DCE2A6E049AC0EB6E2DBF0AFE4B6F635236520AEE2E4FA3176E995
SHA-512:	05CF20AEA71CDD077B0FA5F835812809AD22C3DBEBC69E38AB2C9A26AD694AB50D6985AEC61633B99713E7F57408C1C64CE2FB9CCDAC26661B7167853BDD6148
Malicious:	false
Preview:	........."..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....\|.....}.........................................................................!.....>.....V.....}.....>.......................O...........Q.....r.....T.......................O.................N.......................(.......................5.........................................T...........G...........,.....a.....................................................!...................................*.....g...........Z.................,.......................w...........%.....J...........{.................{...........-.....D...........A.....z.................x.............................,.....V...........R.................!.....x.................I...........Q.....j.....^...........\...........I...................................T...........R...........:.....d.....7...........l ..... .....!....`"....."....9#.....#....b$.....$.....$....E%.....%.....%.....&.....&.....'.....(

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	539514
Entropy (8bit):	5.818959197750725
Encrypted:	false
SSDEEP:	12288:zF2oXDdqsGk2Rspyzir+e/5CvHLg3HXLPxt9R:EoXDdqshpyk/5uLIltD
MD5:	F117E58E6EB53DA1DBFA4C04A798E96F
SHA1:	E98CEE0A94A9494C0CFC639BB9E42A4602C23236
SHA-256:	B46DB20EEBA11F8365296B54469FDD001579852DC1D49A01FC59D2A8BCF880A3
SHA-512:	DEA792A63E0557D9E868C0310EC2A68B713DAF5CF926389E05A0885CDB05433D20F35D087DE269F9584795DA50600966B8FF5DD95583861443A1E90564A89793
Malicious:	false
Preview:	........l#g.e.6...h.>...i.R...j.^...k.m...l.x...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................."..........2.....9.....@.....G.....H.....I.....K....._.....g.....y...........>...........[.....v...........W.................1...................................).....@.................>.....Q.................3.....G........... .....U.....z.........................................6.....O...........2.....h.....y.............................n...........L.....g.................=.....R.................9.....K.................3.....E...........%.....c.....y...........V.......................b.........................................(.......................}...........N.....f.................!.....5...............................................-................o.................M.....i.....~...........\.................#.............................%................. .......................Y.......................V.......................i.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	518515
Entropy (8bit):	5.490293083588063
Encrypted:	false
SSDEEP:	6144:Gbsq8+s/u07QLr32zTMSB29i2iM8nnbrNjSdum4ocyxPbPD+DTubVmavfDszt5T0:sLWroSB2T+E+p578c0JHjcGi/fzzCqc
MD5:	435A2A5214F9B56DFADD5A6267041BD3
SHA1:	36BBC7CA3D998BFB1EDC2FF8A3635553F96CA570
SHA-256:	341C33514C627501026C3E5B9620CF0D9F482AB66B10A7E0FB112C7620B15600
SHA-512:	55271935E18AC27C753431AF86A7DCD1F4A768ADEF1B593BA8E218DA34856A5F9FAF9819A3ECCE3F21F0607BA95100C5CB18CD1A7138EC563090D0391AD5B52D
Malicious:	false
Preview:	........X#{.e.....h.....i.'...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................0.....>.....N.....a...........~.................Y...................................].....\|...........H.....\|.................G.....r.................:.....e.....t...........V................./.......................l.................).................4.....H...........B.....y...........3.................*.............................c.......................N.......................Z.......................}.................#.................J....._.................I.....\.................Q.....`...........;.....x.................G.....g.................,.....J.....e...........'.....k.....}...........^.................).....{.................".......................B.............................>.................y...........O.................c.......................J.....h.....x...........X.......

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	799241
Entropy (8bit):	4.749887536690665
Encrypted:	false
SSDEEP:	12288:qCIVob4zA74dHLYbeHIdN4SGdEDWeUnLYA1785sXMx5xMd8G37gjemS/k/C:ZSe41A0x85nxQP
MD5:	8F58B2463E8240EF62E651685E1F17D8
SHA1:	6C9F302AED807A67F6B93BCB79577397A5AD3CF7
SHA-256:	5A55320D6953EFB5B565893E32E01F6DAE781A16460DF5502C8BA012C893EDFD
SHA-512:	6076D43A73D5FA5192CBE597E018B268CFDC7EFB94A6CB45DAD5B0DA9C3ABF68AAF2EA06F3AD650B28A993605917B6D356339D79F8DD6962D2C40DBF4653EF83
Malicious:	false
Preview:	........w#\.e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.........................................3.....g.....+...........8.....[.....V.....!.......................b.......................>.................=.............................w.............................R...........X...........W...........<...........5.....Z.....@...........w......................./.....k...........k.................W.................'...........$.....\.....{.....?...........@.....k.........................................f........... .............................3.................p.....!.................Z.................+...........:.....s...........Z...........9.....V.....&.................q...........z.................. ....,!.....!.....!.....".....#.....#.....#.....$....{%.....&..../&.....'.....'....6(.....(....:).....).........:.....*....5+....m+.....+....[,.....-....p-

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	465621
Entropy (8bit):	5.545518715933861
Encrypted:	false
SSDEEP:	6144:kcCDD/pC1z11OBIrkn554FwxZf1Chn4RFcmi8G96iMXSOwDE/xWcqVR5sW7Y5FcJ:vecXwIrLFy+5E5FcJ
MD5:	E4C9CED1A36EA7B71634E4DF9618804F
SHA1:	C966C8EB9763A9147854989EA443C6BE0634DB27
SHA-256:	E5CCCDB241938F4A6B9AF5A245ABE0E0218C72E08A73DB3ED0452C6DDFB9C379
SHA-512:	D07A4D62F22A1830D3EC44F0C347E4A7D70B35CEBA126CBDC246A7B3EE7EDA85E2338BAB3EDC7223F579964868136BB10D42C05E0E0FF9F73447B3606D9B2C4E
Malicious:	false
Preview:	........?#..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....\|.....}.....................................................................................%.....9...........>.......................p.................A.................'.................0.....L.................1.....A.................2.....B...........&....._.................m.................+.......................5.......................s...........;.....Q...........\|.................J.......................&.....}.......................[.......................`.......................d.......................V.......................F.....q.................D.....v.................X.......................S.....s.................).....G....._.......................-.................B.....r...........&.....E.....[.................?.....T.................H.....^...........b.................M.........................................*.....t.......................L.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	490754
Entropy (8bit):	5.340013612557628
Encrypted:	false
SSDEEP:	12288:/wmIzbIcvt54uCERdyU7bQg8Wo97pJ8zvgu352ub95Z4sKPe/BrufA:/azl5Bn
MD5:	59FF4E16B640EF41100243857EFDD009
SHA1:	F712B2D39618FFADCF68D1F2AB5A76DA5BE14D74
SHA-256:	C18A209F8EC3641C90EA8CED5343F943F034E09C8E75466E24DCABC070D08804
SHA-512:	0E721A6CBF209AC35272AD292B2E5000D4E690062DDB498DBF6E8E6EE5F6E86D034A7303A46C2B85750245381C78EFAFC416EAD13C1FE0EE5EC6088DD66ADCA2
Malicious:	false
Preview:	........k#h.e.4...h.<...i.G...j.S...k.b...l.m...n.u...o.z...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................'...........5.....<.....=.....>.....C.....U.....e.....y...................................e...................................\.....r...........&.....Y.....m.................B.....Q.................+.....9.................:.....`...........^.................5.......................C.......................D...................................Z.....v........... .....H.....c.............................j.......................\.................%.....}.......................~.................(.....\|.......................h...................................2.....K.................*.....F.................9.....Z.................V.....f...........B.......................^.......................@.....h.....z...........V.................@.................).................N.....k...........`.................&.....z.................H.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1268483
Entropy (8bit):	4.035580260221202
Encrypted:	false
SSDEEP:	6144:GeTVtPcVpmT9Yvh54P5TzotR1cA25tm1vYpiMyy:nViVITqzy5TzccA25tm1vYpiMyy
MD5:	5F80C9DA0C09491C70123581A41F6DAD
SHA1:	3FC9560A954271CF09AAA54EEC34963C72C06E85
SHA-256:	30658D99D753946E9C9C02094C89BE25B710DB77251DF6CD1A8839C29DE5F884
SHA-512:	072C5DB7FE1EB9E6C270D0E9B439CF84EBB3DC374D4F01F01F9341030883F2D6D9C6970FB6EF14BF96FCCB51EADE9CA762F396F89BA1D3DF1230DDA68557FD4A
Malicious:	false
Preview:	........N#..e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....\|.....}.........................................................................=.....k.........................................H...........2.....o...........T.....,.....g.........................................!.....U.....<...................................s...........?.....~.....G.........................................5.................c.......................i.........................................].....?.............................p............ ....6!....@".....".....#.....$.....%.....%.....%.....&.....'.....(....3(....,)...............*.....+.....,....,-....`-...........0.....0....,1....'2.....3.....3.....3.....4....p5.....5.....6.....6.....7.....8.....8.....:....%;.....;....-<.....=.....=.....>....d>.....?.....@....-A.....A.....B.....D.....D....BE.....G.....I.....J.....J.....L....#M.....M....MN.....O.....P.....Q.....Q.....R.....S....^T.....T.....U.....W.....W

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	1173901
Entropy (8bit):	4.287514680628642
Encrypted:	false
SSDEEP:	12288:/jAoZvA07McKNnCRWtgd49+agb0DQWp5B63p1Fm6OiTlC2pFg+NFqUZrOIoXAoIm:s5G35xM/1
MD5:	17B858CF23A206B5822F8B839D7C1EA3
SHA1:	115220668F153B36254951E9AA4EF0AA2BE1FFC4
SHA-256:	D6180484B51AACBF59419E3A9B475A4419FB7D195AEA7C3D58339F0F072C1457
SHA-512:	7B919A5B451EC2BA15D377E4A3A6F99D63268E9BE2865D674505584EED4FA190EAAE589C9592276B996B7CE2FDFAE80FDA20FEFF9EA9ADBB586308DFD7F12C2A
Malicious:	false
Preview:	.........#N.e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.-...\|.3...}.E.....M.....R.....Z.....b.....j.....q.....x..................................................... .....h.....R...................................U.....p.....<.........................................T............................./.....g...........W.........................................:.......................A.....8.................v.......................V.........................................".....K...........{.............................A...... ....\|!....."....e".....#....n$.....$....5%....U&....&'.....'.....'.....(.....)....C..........+....~,.....,....<-.........../....(0....g0....h1.....2....x2.....2.....3.....4....Z4.....4....Q5.....6.....6.....6....^8....[9.....9.....:.....;....8<.....<.....<.... >.....>.....?.....?.....A.....A....yB.....B.....D.....F....GG.....G.....I.....J.....J....FK.....L.....M.....N....eN....lO....4P.....P.....P....6R....1S.....S

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	987501
Entropy (8bit):	4.326923937635645
Encrypted:	false
SSDEEP:	12288:OgFN2HN9LyZYA1T6z1L/LLftDjsAnILwgv1V5UBGsL3fBj8BlzEdq3Ro9lGdI9uN:OgFYdK5J5j
MD5:	4917873D8118906BDC08F31AFB1EA078
SHA1:	49440A3B156D7703533367F8F13F66EC166DB6E9
SHA-256:	D051B400096922089F6DAA723FAC18C9640BA203B2879AAC4CA89B05738DD32D
SHA-512:	30E6446BAD54B86BE553FA293C7A92EC221ADB54B99624ED69702DF75347A98697158041A45F77ECE4E7ED0FDA41306EF21EB27981F24F0A4E42E8306175A88E
Malicious:	false
Preview:	........."/.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{.......................................................................Y.......................<.....{.....C...........D.....n...........Q...........'.....`.....;.......................P.................Y...........".....;.....^.........................................[.....)...........T.....x.....C...........P.....w.....K...........d.......................k.................#.....{...............................................w...........p..... .......................@.......................Q.......................6.......................1.....................................................Z...........H ..... .....!....J!.....!....X".....".....".....$.....$....^%.....%.....&.....&....&'....V'....+(.....(.....)....J)....I.........M+.....+.....,....t-..........=....../.....0....A1.....1.....2....L3.....3.....3.....4....D5.....5.....5.....6.....7...."8

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	501122
Entropy (8bit):	5.618531845968946
Encrypted:	false
SSDEEP:	6144:tgGjoIj9GAb0GKPRquxFX7gFZ7yMqPO4ppXHG42ge+54n/R+Pi1c2vdTAMTw/KUX:tgGHgo0G0RqU8wZHGe54n/C
MD5:	55E06CD9356D0FB6F99932C2913AFC92
SHA1:	AA5C532DDB3F80D2F180AD62CE38351E519A5E45
SHA-256:	AFCBF02420DC724059F70D1DC6FFA51F5DD75136D9E1E8671D92D5D14955EDF9
SHA-512:	813C180CB1AA205034497BE5FC8A631FF117E5ED17CDF0AC59B7569D74D849B385852A15BBADD3146F942C58BAB80D94BF0980D13CA4B4424D1CB1DF0CB1A2CD
Malicious:	false
Preview:	.........#1.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|...............................................................................................2.......................v.................K.................!.......................0.............................o.......................y.................(.................^.....{...........@.....r.................7.....a.....q...........].................7.......................o.......................o.......................l.......................l.........................................,.......................,.......................$.......................*.........../.....}.................\.......................O.....q.................6.....n.................W.......................`.......................S.....~.................g.................n.......................(...................................T.....p...........4.....d.....y...........R.......

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	856077
Entropy (8bit):	4.859457960004309
Encrypted:	false
SSDEEP:	12288:8Jzdfzlw5Cgnbz/T0hoaiJITt5eB3IjeAjmEFIOuHLNiXEqqbo3/d:KdfhAw56EL
MD5:	381CB33C2D4FD0225C5C14447E6A84E0
SHA1:	686B888228F6DD95ADE94FEE62EB1D75F3E0FC93
SHA-256:	C2A6B16ABEAB6E18276BC1636555E93218763B9C99CACD0B42481B35E3A11820
SHA-512:	F7A2828AA4CD85F07A5D66832F247F70951ABF34F81A282DC41EC51875BA70D940353D010B605C56CC59BEE47309AA311099D4E6EBD17F3C1538521D0CDDF4B6
Malicious:	false
Preview:	........%#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.$...t.-...v.B...w.O...y.U...z.d...\|.j...}.\|........................................................................................._.....C.......................^...........d...........Y.............................(.................s...........Z.........................................h.............................).....e.......................7...........v.......................c.............................:.....t...........m.................^.................;...........:.....x...........J...........H.....o.........................................T.....m...........\|.................p...........>.....Y.....R.....".............................C.....e...........;.....d...........7...........V.....q.....f...................................>.....k........................ ..... ...._!.....!.....".....".....#....j$.....$....y%....=&.....&.....'.....'....F(.....(.....(....G).....)......... .....*.....+.....,

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\ur.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	749985
Entropy (8bit):	5.130337183789155
Encrypted:	false
SSDEEP:	12288:W2U9cmoa5DD8P4WrDD6yACLUj5DDPEFYW7BYcQYriwadcJKwUxuvco/9NjjFpvxR:1a8G5bWp
MD5:	861FFD74AE5B392D578B3F3004C94CE3
SHA1:	8A4A05317A0F11D9D216B3E53E58475C301D7EA5
SHA-256:	B9F22A23368BF1E21F3085583ECB775CCE8045176721FF6AE798B06BD2810DBC
SHA-512:	52EDE35B7ED1FB6E51B18E450B95C3245D326F2AFDA646E3642EE68B714DCF9A726AFE32E2759E9EA87A104F4A59E6FC2C60B3275AAD8332AE1C626231E6747B
Malicious:	false
Preview:	........e#n.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....4.....L.....f.................\|.....>.......................T.......................z.....................................................j...............................................X...........N...........K...........,.................;...............................................5.................j.................{.................^..................................R.....l.........................................t...............................................I.....\...........g.......................C.............................@.....p...........Q.....~...........9.............................s.............................X.....{.....)............................z...........'............ .....!....T!....6"....."....`#.....#....j$.....%....g%.....%....-&.....&.....&.....'.....'....J(.....(

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	592944
Entropy (8bit):	5.79362677638915
Encrypted:	false
SSDEEP:	12288:9t12XV1+crwJ2roEw/aBuIZgsHXW0YYEDOr9g/C508jUmBnAi9wziMHQmwtm4:L12XX+crwJ2iaLZgsHG0Y3C508ImCi9v
MD5:	4076D3C0C0E5F31CF883198C980D1727
SHA1:	DB51B746216EA68803C98D7C1A5A2B45944359F3
SHA-256:	F1458C4CE4CA708E849EB0C68A5157360EF003F3A9C95628D5CA12ADA303B379
SHA-512:	80E4E960218F7D84423124C34352251411BAF008E821A344A0B6C2E7F1483694010F28B7DE21C7E2C69ABB4EC92E0D9CBDDEED6279B90C47245F4CBC500CDB77
Malicious:	false
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.>...y.D...z.S...\|.Y...}.k.....s.....x.........................................................................................r.............................j...........3...........'.....M...........N.......................b.......................j.................U.................Q.................#.....Q...........b.................R.............................^.......................,.................0.......................J.......................e................."........... .....h.................U.......................g.......................t.................'.............................2.................7.......................y...................................N.......................B...........&.....[.....}...........z.................q...........'.....N...................................\|.............................6.....O...........".....U.....i.........................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	428244
Entropy (8bit):	6.66612560644761
Encrypted:	false
SSDEEP:	6144:rnmNoByFw9qnvdNzuIaG/7C5ccJu7kzDg5CJTNY6BoHHulW:r2oBew9qvfz/aJ5ccJuAg50TNY6BoT
MD5:	3210460A24F2E2A2EDD15D6F43ABBE5F
SHA1:	608FF156286708ED94B7AE90C73568D6042E2DBD
SHA-256:	0F8D42D7F0B0B01AAFAD6AE79F0BD0CA518B2DB94287B09DF088BC093F15F605
SHA-512:	F97427DBA4217E01A7ED395C453D03DDA4F2258CBA589258DA0EACFDE427BF442CDDEF541A23E7782914433E70A9623E904A5070DEBA9F9D50DDA20732EB5E86
Malicious:	false
Preview:	........."..e.2...h.:...i.B...j.E...k.T...l.[...m.c...o.i...p.n...q.t...r.....s.....t.....v.....w.....\|.....}.......................................................!.....#.....(.....1.....=.....O.....a...........T.......................g.......................n.......................w.......................v.......................A.....h.....u...........".....H.....b...........=.....~.................L.......................2.....[.....g.................M....._...........4.....r.......................-.....G.............................V.......................3.......................;.............................s.......................Q.....y.................*.....S....._...........E.......................5.....U.....i.................6.....M.................(.....:.......................;.............................W.......................W.......................s...........,.....>.................B.....W.................-.....<.............................Z.......................V.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	424179
Entropy (8bit):	6.677156018886683
Encrypted:	false
SSDEEP:	6144:svATQ4LawqVPkG49+J+k2i2iurW4hcv50Ynzq1TfAyn7zeGTs:sY/2mG4+CW4hcv50YnzeNn7I
MD5:	F466116C7CE4962FE674383D543C87F6
SHA1:	F65BF0DC1F1B15C132674FB8FF540F7D2AFE1D6E
SHA-256:	FF3A294FD1AFB1FA7AAF53FBC4396643A12ED132633C5C86F14C16B88FA94A7B
SHA-512:	4851A08069FCAC75E4051E53D4526789BFE6C393AB963E8263803BBF6E96CB150E9BA741650EFB5EE500E8A757D8512EB17DC268CEC1AB6FD3ACFAC62F7DA27D
Malicious:	false
Preview:	........."..e.....h.....i.....j.....k. ...l.+...n.3...o.8...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....\|.....}...............................................................................'.................U.....g.................8.....D.................6.....H.................%.....7.............................`.......................<.......................0.......................(.............................e.......................`...............................................[.....o.......................9.....E.............................i.......................F.......................).............................e.......................>.....g.....s...........;.....p.......................0.....D.......................^.......................J.......................3.....s.......................=.....`.....r...........%.....T.....n...........Z........................................./.............................:.....O.....\.................-.....?.............

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources.pak

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	5483537
Entropy (8bit):	7.995680005569416
Encrypted:	true
SSDEEP:	98304:+APFNXMmWPVctFCZcSENQjxh1Z/p6uNXrwrXRVunEVvXjAfz3hIkrT7s:+APFNXMddCM0Ghz/xpkrX2nEVvXGqkXA
MD5:	E2088909E43552AD3E9CCE053740185D
SHA1:	24B23DD4CAD49340D88B9CB34E54C3CA0EB0D27F
SHA-256:	BBA36D4D18D64D9627F54C54FD645C5BA459D25A59ACC5228210BD707AEF67FD
SHA-512:	DCEFACDDEC38D8941C7D2D7B971B6F22DD0ACB4116E48891D1D48A4D88968DA12B152CCB7591715C88F8E14C315E235D1C4E6852CC38B9246091C50226900DE6
Malicious:	false
Preview:	........@...f.....{.2..\|..-..~..0.....C....;E....iF....rQ......................+.................V...........q...........L.....l.....J..........<.....<.....<.....<c....<.....<"....</....<.....<.....<`3...<V:...<a>...<.>..I=.>..J=.C..K=.D..R=XI..S=.S..T=.a..[=s...\="...]=....^=...._=...`=(...a=....b=<...c=...e=r...f=.....=.....=.....=.....=.....=.....=4....=3....=7....=.....=.....E....+E....,E@...-E.....E. ../E.+..8E.<..9E.N..:E.`..BJ.l..CJ)y..DJ=...EJ...FJ....GJ\...HJr...IJ....JJ...KJZ...LJ....(K...)K....J[...K[....L[.)..M[.+..N[G-..O[.0..P[.2..Q[.5...[.D...[.I...[.N...[o]...[d`...[.e...[.f...[Ah...\.i...\.r...\!x...\.~...\y....\....\8....\....\.....\....\Z....\.....\.....\!....\,....\.....\.....\.\|...\........................>.....t...........t.....e...........1..........G.....M...........?...........n...........".........9.........b.........y.........<.....u.......7..........O....................o.........................a...........-.....1.....y.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\app-update.yml

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.500006753769817
Encrypted:	false
SSDEEP:	3:ohFDukNeoZEXWmGKGKIKiIzkaA2SWQniIx+OIGrEq:ov/eoZSWmeT4zNAlWQnrsOPrV
MD5:	A49AB4C2B2CF7875FDD5CB5C9EE60353
SHA1:	20D53D61209B756FC95F697095E7AD5FE854093C
SHA-256:	DC331ABE8C4BDE9DB8D36B156E37EB4CE1517489FD9DA944A9C91F2A95E8C9FF
SHA-512:	8F4D13E4545EDAF6F30E6D455FF05E480FA81BBD5E8B02ED3806F6D9F45D1BE18DDD6A7DBAA60FE15C0DE584E29C4D51A77738B2AA1600E937B17F52D016E359
Malicious:	false
Preview:	provider: generic.url: https://package.cdn.ivysci.com/ivysci-release-updater/.updaterCacheDirName: ivysci-desktop-app-updater.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	71688850
Entropy (8bit):	6.004788849356217
Encrypted:	false
SSDEEP:	393216:ublwuOF+IOcEuUq1TyBPkGDwA9UG32lPheRn1Fnpq2TypT5z4Cr1GxvcY5OKWMYj:ublw9Xu2oXme5dBXG
MD5:	106EC1F6B88B7C2EA5960DC33EE7A8BA
SHA1:	73ADE9E59200DA2ECDA2F665BF04B4E0CF60A45A
SHA-256:	FE706458B52ED1F828862FE74BFBCABC6C6266F305B671627876DB860D74A464
SHA-512:	2662E4BAAAEA9573C60DAEA16B1E2B2734866522EF3480753EB7546035845B0B96058B55EE2A748BDC7FC30927544953BF10CC99C31438812CC4CFBAD6EAED64
Malicious:	false
Preview:	....P...L...F...{"files":{"main.prod.js":{"size":1447893,"integrity":{"algorithm":"SHA256","hash":"94ec0bc5c3a3c06a8b27484ed5eee610bb32f3e2ffa6f15530f78f5218b3d8e3","blockSize":4194304,"blocks":["94ec0bc5c3a3c06a8b27484ed5eee610bb32f3e2ffa6f15530f78f5218b3d8e3"]},"offset":"0"},"package.json":{"size":330,"integrity":{"algorithm":"SHA256","hash":"efe6dfd3e405123f695f958a243e07b887f83ee233cfe0a0715398f6949dc2c6","blockSize":4194304,"blocks":["efe6dfd3e405123f695f958a243e07b887f83ee233cfe0a0715398f6949dc2c6"]},"offset":"1447893"},"windows":{"files":{"browserTabs.html":{"size":661,"integrity":{"algorithm":"SHA256","hash":"80f738a0965306ee8ea6d19c694ddf37cfb8ba0a5e7036faf661982611d4e860","blockSize":4194304,"blocks":["80f738a0965306ee8ea6d19c694ddf37cfb8ba0a5e7036faf661982611d4e860"]},"offset":"1448223"},"downloadManager.html":{"size":610,"integrity":{"algorithm":"SHA256","hash":"6e64ef6ef73793dc833b2fce4988dedc3cf25d10ebefcd1cbb74e3b271ea8f84","blockSize":4194304,"blocks":["6e64ef6ef73793dc

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128600
Entropy (8bit):	6.7713902645191695
Encrypted:	false
SSDEEP:	3072:ycbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlQ/n7:TPrwRhte1XsE1lM
MD5:	623136DA857A6EAFE86A3DA9FD16ABD7
SHA1:	E65D5DF5FCE74D19DA556923C1CF42629847AA34
SHA-256:	05EDFDD2A88888C4D58B4C23E2FC872F3A7F88C7E665B2A4FE619197486BC0C8
SHA-512:	A86708B9A20F8F1AE9333E51C9E7F9372D7B544BEF8B6DC26F0CDBFE9B54E28CB247C482ED66E3E46080A319AC4BA3AD121434ED9F0F05BA5A6047FE16476094
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@..................................E....@....................................P.......x...............XR......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\update.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	504920
Entropy (8bit):	3.7437396099169953
Encrypted:	false
SSDEEP:	6144:8bJhs7QW69hd1MMdxPe9N9uA0hu9TBF5oI:8bjDhu9Tv51
MD5:	EF56178B4591A8949A5823A6B67D429D
SHA1:	067FB30534DC87D0643FD194CE5A76936D7D7585
SHA-256:	E68460A26CA5ABFFCFC1CE7BEE43C906EF744761C81CFF85B3B89D7133FAB616
SHA-512:	DED793C61CD4A9BE57747BBBA33E731B99FE6C1A000EE0ECE5DA125B77EBB210A1B27CE31E9DC4C8ED8D18A6F79A3A5BE899937E4C9A82A4ED326F1335877EB6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....msZ........../....2.`.....................@.....................................Z............................................................... ...............b..XR..............................................................H............................code....Z.......\.................. ..`.text........p.......`.............. ..`.rdata..-K.......L...d..............@..@.pdata..............................@..@.data....#..........................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\darwin-arm64\pdfinfo

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE>
Category:	dropped
Size (bytes):	1536156
Entropy (8bit):	6.1642227471656
Encrypted:	false
SSDEEP:	24576:T7vEntlaQB1D3wiPt2NRRkRDE83SmWIPKc/twVuFZT8d3O:T7vEtlZB1D3wiPqGRjCmW1c/twUVue
MD5:	2F316A6DE726D2D234835D9C98C4CFB4
SHA1:	017100DEBDB88BCDBB5D2C62188C6873FA0ED83F
SHA-256:	237749A11EB3CDBE849F599D4F579AEA256FD2667A67E238F7E3328352AC11AA
SHA-512:	3711AAB8AB926024EE92DF9962EF039B1022DA13615F7F7C1B3494ADCF49E1FCDA0A6039D51768B8EE7549A303148A8CB65E000BAF4CCCE2D972C09DF18D43AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.................... .....!.........H...__PAGEZERO..........................................................x...__TEXT..........................................................__text..........__TEXT..........0.......g%......0...............................__stubs.........__TEXT...........=...............=..............................__stub_helper...__TEXT...........?......X........?..............................__const.........__TEXT...........C......q........C..............................__gcc_except_tab__TEXT..........t........O......t...............................__cstring.......__TEXT...........D...... ........D..............................__unwind_info...__TEXT..................`(..........................................x...__DATA..........................................................__nl_symbol_ptr.__DATA..............................................X...........__got...........__DATA..............................................Z...........__la_symbol_ptr.__DATA..........

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\darwin-x64\pdfinfo

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE>
Category:	dropped
Size (bytes):	1536156
Entropy (8bit):	6.1642227471656
Encrypted:	false
SSDEEP:	24576:T7vEntlaQB1D3wiPt2NRRkRDE83SmWIPKc/twVuFZT8d3O:T7vEtlZB1D3wiPqGRjCmW1c/twUVue
MD5:	2F316A6DE726D2D234835D9C98C4CFB4
SHA1:	017100DEBDB88BCDBB5D2C62188C6873FA0ED83F
SHA-256:	237749A11EB3CDBE849F599D4F579AEA256FD2667A67E238F7E3328352AC11AA
SHA-512:	3711AAB8AB926024EE92DF9962EF039B1022DA13615F7F7C1B3494ADCF49E1FCDA0A6039D51768B8EE7549A303148A8CB65E000BAF4CCCE2D972C09DF18D43AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.................... .....!.........H...__PAGEZERO..........................................................x...__TEXT..........................................................__text..........__TEXT..........0.......g%......0...............................__stubs.........__TEXT...........=...............=..............................__stub_helper...__TEXT...........?......X........?..............................__const.........__TEXT...........C......q........C..............................__gcc_except_tab__TEXT..........t........O......t...............................__cstring.......__TEXT...........D...... ........D..............................__unwind_info...__TEXT..................`(..........................................x...__DATA..........................................................__nl_symbol_ptr.__DATA..............................................X...........__got...........__DATA..............................................Z...........__la_symbol_ptr.__DATA..........

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\linux-x64\pdfinfo

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d2a72c1cce36f6fe31f51ecbf05bbd5d6b5133ee, not stripped
Category:	dropped
Size (bytes):	1686384
Entropy (8bit):	5.910445067512323
Encrypted:	false
SSDEEP:	24576:QAHveQDkAb/ITN7qVTbTqras0JKOfqIkDbaPxCsRy3iyPXzx5Qd:LvemhTIEmras0JKOQKPxCsRy3iGM
MD5:	7D8C6B8F954C6EFB3A1CFCD8EDF7DE56
SHA1:	092065E76C56EB5D3532FB1C46F6BB45B65DCDC6
SHA-256:	1CAA15E3A686C7127EF599105BD7E510CABC0A4B60D8C2CA1B2D1BBB99FBAE5B
SHA-512:	0C1EB28826FED727A89B95B84705D2190A0E229869DA047A963367AC86C47DDB3221A790BD22DC820F5A463DB0E902E1C09C1E8B7D9B4FBBA7E9D3A69AF8458E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>.......C.....@.......p...........@.8...@. ...........@.......@.@.....@.@.....................................8.......8.@.....8.@...............................................@.......@......#.......#........ .............(+......(+r.....(+r......\|......X......... .......................s.......s..... ....... .......................T.......T.@.....T.@.....D.......D...............P.td....(.......(.O.....(.O......R.......R..............Q.td....................................................R.td....(+......(+r.....(+r......t.......t............../lib64/ld-linux-x86-64.so.2.............GNU............. ...............GNU..,..6..1....[.]kQ3.....j............J.=.....B .. ...$i.. .........@@(.E!......`.B ...B..R`........ ......@!.....P.......(......(@...$e........a.P...!B(. $@..... @.... .. B....@ A............X.4 . ...H.........P..........@...... .......`...........8......(...@.....&...(...AT.. @..R ..F( ......@H\|S.. ...P..$.)H!...@..... ..`.. H.........T...... ...D4.

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x32\pdfinfo.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1008728
Entropy (8bit):	6.492204951550375
Encrypted:	false
SSDEEP:	24576:z5UWtCMK5vFBp1j7gdLorfGQ/LNT1gXG3DFfFUPIB6K+/v2mWGUy:z5He1j7dB1gXGRFBU/v2mWGUy
MD5:	949EDEA930597DF1ACE5C667B04DB073
SHA1:	492F911905DAB690742F4C3B3A98B8073B21599B
SHA-256:	B4BA7910A9FE1DAE242CE72C1D2D88E7766FDAED407DC377E4838C9B42EE00F7
SHA-512:	020495DDEBBBF750F4E892E2DE34DF3594FB5EA52DD022D0F9AB44BA60616228AB2CFBD9313C20B818F055339861AB72E6B3731CF02A9E8FB2E1E4C34FE83CDC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............[...[...[...Z...[...Z%..[...Z...[..z[...[..Z...[..Z...[..Z...[...Z...[...Z...[...[.[&.Z...[&.Z...[&.Z...[Rich...[........................PE..L......`.....................R......;o............@..........................P......J.....@.................................t...P.......................XR......D....6...............................6..@...............P............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc................`..............@..@.reloc..D............b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\resources\extraResources\xpdf\win32-x64\pdfinfo.exe

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246296
Entropy (8bit):	6.023312744795341
Encrypted:	false
SSDEEP:	12288:hZSqNKN9nBmrQdBvbjiJVnTOLMnZwpuHN58e65tO7N3EPQpuopGNikkcKZ:hZSt3iPnTnnZwuJgtOJ3EPoug3cy
MD5:	7395484F565971AADB1CABDE86200D5F
SHA1:	FC787A5C2DE2969EE4DCB9122B0AB7FACEE5D090
SHA-256:	0C93DEE3D2AA9F1DCEA47AE4997862BE1BF25FDFC16FFA9FF03B81D0EDEFEAE7
SHA-512:	41EA378DD948C731D1055640605A93D9B421697FB12254E51CAB33BDD04294617C91DD7CB83CF84FC579B2D93465D8961A50B069184CBC516E0B9419039F424B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r..Br..Br..B..Cd..B..Cc..B..C..B..eBq..B .CX..B .C`..B .Cz..B..Cq..B..C{..Br..B...B..Cs..B..CE..B..Cs..BRichr..B................PE..d...2..`..........".................4w.........@..........................................`.....................................................P............ ..._......XR......0g...................................................................................text............................... ..`.rdata..............................@..@.data...h........p...x..............@....pdata..._... ...`..................@..@.rsrc................H..............@..@.reloc..0g.......h...J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	267462
Entropy (8bit):	4.19770221494855
Encrypted:	false
SSDEEP:	3072:8LuAqiYp4bhaz8Le7ICHKhsqdzoGq/p2Vy:hiHbhaMAIyAsqxip2Q
MD5:	6FCB8A6C21A7E76A7BE2DC237B64916F
SHA1:	893EF10567F7705144F407A6493A96AB341C7CCF
SHA-256:	2BCEEF4822CA7CC3ADD4A9DCB67C51EFB51C656FCE96A3B840250DE15379959C
SHA-512:	3B745740BBBE339542EF03FD15DD631FB775E6BF8CA54D6D2B9CEAD3AA5AAFC4CAB49E507BC93641E581412BBEB916A53608D5F5D971EA453779E72D2294DAFB
Malicious:	false
Preview:	........a...1.Nk11.8.172.18-electron.0...........................................@..fT...l...........?..a........a........a........ar.......a8.......a............e....f...bf....f..."g....g....g...Bh....h....i...bi....i..."j..(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	data
Category:	dropped
Size (bytes):	626313
Entropy (8bit):	5.180772010538009
Encrypted:	false
SSDEEP:	6144:jMWiyz4J+1OFZAsXbJ8qPOzhXvKwvrBTbvUyMR/GLrOp:j2+lOF4h/DvNHvUiap
MD5:	1A37F6614FF8799B1C063BC83C157CC3
SHA1:	8238B9295E1DDE9DE0D6FD20578E82703131A228
SHA-256:	4FBE07F71B706C2A2948EBA9A6B1979E23C83342B190723A6EC5251B2D6DAD7C
SHA-512:	6677F65A0E26FDC2CFF6CEF0231F5E5F0713EE7C5CF7F488599A3C7AC3E8365AFAEC10B35D6145EA58D364151D8BCB08308765693A9797EA99B894D6E8224AC7
Malicious:	false
Preview:	..........N5<Dk11.8.172.18-electron.0..............................................1....8.......E..........0...a........a........aT.......ar.......a8.......a............e....f...bf....f..."g....g....g...Bh....h....i...bi....i..."j..(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5180416
Entropy (8bit):	6.360584977154033
Encrypted:	false
SSDEEP:	49152:Y6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzo:5h3aMXoSHfPwksHldLiuNr
MD5:	2B032D9C66F8644B0A1D157968D46557
SHA1:	9426C4CA56C9A07789127D9691CD1139020DB773
SHA-256:	233445E46B2CC443964FA4CB9074DB65D66027C6DD4E73799D58DE06A76E0200
SHA-512:	5841C378DA834572D8ED6AF37080E6FDE945A635737EDE78919F9CB2E9942CB8430F1706ACFC8805DB65D807C12F6032A70181CCB13EC3B413DFFA4CB3C8C6A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .....h>......... 17.......................................P...........`A.........................................`J.~.....J.P.....P......0N..g........... P..}....J.......................J.(...@.>.@.............J.P............................text....f>......h>................. ..`.rdata..L.....>......l>.............@..@.data...P....pK......PK.............@....pdata...g...0N..h....L.............@..@.00cfg..8.....O......RN.............@..@.gxfg....-....O......TN.............@..@.retplne......O.......N..................tls....Y.....O.......N.............@..._RDATA..\.....P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}... P..~....N.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	953856
Entropy (8bit):	6.582979756960565
Encrypted:	false
SSDEEP:	24576:oYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sZ:oY65/M387R56Z5WoDYsHY6g3P0zAk7s
MD5:	BF294513509A6A782E30232442E76026
SHA1:	4C81C44029578F8A6978628D1469EA4DB89B3658
SHA-256:	67E799F325A88D53869FDFFCABBFE1D662336186C535B11EAB3BFD57E41442D9
SHA-512:	63A85967165ABA30EF39FDAC3C4F591A369C3123E1B5C9DCF40256D2A3C223282AA1BEFD08B18596CDFE8113A8716EFD07848DF7E12A4CE161736A94F53B5F29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f^.e.........." .........................................................0............`A........................................p...<!...3..P............ ...s........... ..L...............................(...@...@............7...............................text.............................. ..`.rdata..............................@..@.data...(M....... ..................@....pdata...s... ...t..................@..@.00cfg..8............J..............@..@.gxfg...P).......*...L..............@..@.retplne.............v...................tls.................x..............@..._RDATA..\............z..............@..@.rsrc................\|..............@..@.reloc..L.... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\SpiderBanner.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.5347224014600345
Encrypted:	false
SSDEEP:	192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5:	17309E33B596BA3A5693B4D3E85CF8D7
SHA1:	7D361836CF53DF42021C7F2B148AEC9458818C01
SHA-256:	996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
SHA-512:	1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	74505820
Entropy (8bit):	7.999995592449252
Encrypted:	true
SSDEEP:	1572864:x4gPXMoRgtY3Wv0+gSqEFDlbkVV163BcRrITcyBz8igZsxQB:x4Acz63WsVSvgX6RcRrIzzSOx4
MD5:	D81D828CD4F959A73E061076A636DB9E
SHA1:	CDBF9441176E73BF9712545475ED45A6147A5515
SHA-256:	8D72D9BDB945C7613DD182B7B54E165DAC6B97B1CD79FABFB4749F91EEF3B225
SHA-512:	628DB238B6145D25E0B2B86FF0885DF4A29830A63565FEC7315BD7C3CCD25045D816A91E7946CF7E9FBDE8CA8325F8CC9BFA1B7B04E74C147E532D5846B1C8FA
Malicious:	false
Preview:	7z..'.....B..p.....%.......`.......]...6...-g../B.&.....M.yC.._.MF........].(.vF.7...E....7.[;.R.a......7...M...;{.....P...+..Dh.:m...L=F.`Z...el.X.DX.....L..pN...>.A.\|1.p.!PE..7.T\.F!....%.".....;..z\|x.%r.....6.j..m......S.H\..f2.=......7..s..c...........q..um...G....%[e./^U.y..........{.o+.K.....I.4..0..j0..0<......B.2\|......(.E...{..R.,.@..2.u.f..Z..+:...`.lA...;`....<....7.0kT. L._l.~>...Z"....~.B"......1~s.'9%...5U.V&~...^........c...]Lm.....C<....z..riF..>...<.6^.pRu.6.fc .ZI...R:`..@y{..i6...5.iRm.:.T....U.JN.....#.UJ.;d...x3..c>. ..n..}G.7.[.M.1...fTiV...I..a>......I......g..Q...@{..@z.s....3.Y...C}F+;...y..5..R......k;D....+4....d.-.....LQ..j.K.%..f.)....u.$..1I.4..J...Z:..Q_....C.{.k.\|.'...x..tW.......3..].;..E.[a.;.1.z".X._..a.iT7}....^..z'R..o....E..{C.o...p.P...2%.b.....cWV.d<UqL?.mz..1....@...t.@....5.f....8.$..XH...SE.]...O.8tV..g.(.M.t.(B\...<...fZ...^w0.<...n.++.Y....C.->.......0,0.m.w..dX....e..M..Qx.B.7.s.....H.y?lU.._...

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:	96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.99998496152135
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ivySCI-5.6.3.exe
File size:	75'040'080 bytes
MD5:	a4d6d369b2bdb57b71adb6386c979397
SHA1:	d4167f19655f07001d63cf6bebf0beddebf6de35
SHA256:	2044c7daa56b6eb1730b02664788b8c559b29e2736293ba07350b3f1d9fdecd1
SHA512:	1a13b8d0ba1a069f308e9f6665141fd2ece0de8dfcb3a898f57a35ec338183013f23cc9cf8c27e016440d31fc822c6435d60ac703d7be96e243e07abdd3f0a17
SSDEEP:	1572864:zD4gPXMoRgtY3Wv0+gSqEFDlbkVV163BcRrITcyBz8igZsxQN:zD4Acz63WsVSvgX6RcRrIzzSOxA
TLSH:	C6F73315C800A93FD8D0EA3496C48B76FD63F5F9CC1A08C62EA1616E75BD2DA1D6C8F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	7c5f7463676cbbb7

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	13/11/2024 06:50:24 13/11/2026 06:50:23
Subject Chain	CN="Nanjing IvyScience Information Technology Co., Ltd.", O="Nanjing IvyScience Information Technology Co., Ltd.", L=Nanjing, S=Jiangsu, C=CN, SERIALNUMBER=91320113MA21W4U32A, OID.1.3.6.1.4.1.311.60.2.1.1=Nanjing, OID.1.3.6.1.4.1.311.60.2.1.2=Jiangsu, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	891958224FC02F86638BB33D456F83F6
Thumbprint SHA-1:	17DCB29633D96BC93F80CA5802173462FBCA17FA
Thumbprint SHA-256:	56DFB4C5F4910113BF4783720626EA5DFDEA9C6981633A08C1B0D2ED172F61A9
Serial:	22B7BA873A211750DF95FF0A3369AF74

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007FB0BCD6A3F3h
push ebx
call 00007FB0BCD6D6A5h
cmp eax, ebx
je 00007FB0BCD6A3E9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FB0BCD6D61Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FB0BCD6A3CCh
push 0000000Ah
call 00007FB0BCD6D678h
push 00000008h
call 00007FB0BCD6D671h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007FB0BCD6D665h
cmp eax, ebx
je 00007FB0BCD6A3F1h
push 0000001Eh
call eax
test eax, eax
je 00007FB0BCD6A3E9h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x4ef8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x478b2f8	0x5258
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x4ef8	0x5000	d721de98bac5b772c9659ab7f8b93454	False	0.6544921875	data	6.634086683342011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f4a8	0x2cec	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809565217391304
RT_DIALOG	0x1a2198	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a23a0	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a2498	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a2588	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a2788	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a2878	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a2960	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a2b50	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a2c38	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a2d18	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a2f08	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a2ff0	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a30d0	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a32c8	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a33b0	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a3490	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a3698	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a3790	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a3880	0x14	data	English	United States	1.05
RT_VERSION	0x1a3898	0x234	data	English	United States	0.526595744680851
RT_MANIFEST	0x1a3ad0	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	12:46:23
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\ivySCI-5.6.3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ivySCI-5.6.3.exe"
Imagebase:	0x400000
File size:	75'040'080 bytes
MD5 hash:	A4D6D369B2BDB57B71ADB6386C979397
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:46:24
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ??ivySCI.exe" \| %SYSTEMROOT%\System32\find.exe "??ivySCI.exe"
Imagebase:	0xa30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:46:24
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c1080000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:46:24
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq ??ivySCI.exe"
Imagebase:	0xff0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:46:24
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\find.exe "??ivySCI.exe"
Imagebase:	0x240000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:47:11
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe"
Imagebase:
File size:	173'016'664 bytes
MD5 hash:	5497B6AEDAC0DEA15ABC2DCB652E19C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:47:23
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe"
Imagebase:
File size:	173'016'664 bytes
MD5 hash:	5497B6AEDAC0DEA15ABC2DCB652E19C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ivySCI-5.6.3.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\??ivySCI.exe

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSE.electron.txt

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\LICENSES.chromium.html

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\chrome_100_percent.pak

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\chrome_200_percent.pak

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\ffmpeg.dll

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\icudtl.dat

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libEGL.dll

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\libGLESv2.dll

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\resources.pak

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\snapshot_blob.bin

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\v8_context_snapshot.bin

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader.dll

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vk_swiftshader_icd.json

C:\Users\user\AppData\Local\Programs\ivysci-desktop-app\vulkan-1.dll

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\??ivySCI.exe

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\nse2D43.tmp\7z-out\d3dcompiler_47.dll

Windows Analysis Report
ivySCI-5.6.3.exe