Edit tour

Windows Analysis Report
442.docx.exe

Overview

General Information

Sample name:	442.docx.exe renamed because original name is a hash value
Original sample name:	.docx.exe
Analysis ID:	1567177
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
Infos:

Detection

RMSRemoteAdmin

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

442.docx.exe (PID: 5692 cmdline: "C:\Users\user\Desktop\442.docx.exe" MD5: FB8117B1A3F0924100FBC209DBBB1BB1)

msiexec.exe (PID: 4536 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

WINWORD.EXE (PID: 5780 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

msiexec.exe (PID: 760 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5068 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 684489E62C864DF5C283E9DB67C8FC1A MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 7372 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi" MD5: CB9BE257064162076EBD4869CD97E166)

rutserv.exe (PID: 7492 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7692 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

svchost.exe (PID: 5736 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7188 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rutserv.exe (PID: 7864 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7928 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rfusclient.exe (PID: 7956 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 3136 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 7968 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39e594:$s1: rman_message 0x46d594:$s3: rms_host_ 0x46df4c:$s3: rms_host_ 0x82acb0:$s4: rman_av_capture_settings 0x877858:$s5: rman_registry_key 0x8778a4:$s5: rman_registry_key 0x543d6c:$s6: rms_system_information 0x2f1a18:$s7: _rms_log.txt 0x503238:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.3309338966.0000000003858000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000014.00000002.3320249204.0000000005420000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000013.00000002.3304532933.000000000206A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000013.00000002.3304532933.0000000002046000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000014.00000002.3309338966.000000000388A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000014.00000002.3320249204.0000000005464000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 7372	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7492	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7864	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.0.rfusclient.exe.c70000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
12.0.rfusclient.exe.c70000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\442.docx.exe", CommandLine: "C:\Users\user\Desktop\442.docx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\442.docx.exe, NewProcessName: C:\Users\user\Desktop\442.docx.exe, OriginalFileName: C:\Users\user\Desktop\442.docx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Users\user\Desktop\442.docx.exe", ProcessId: 5692, ProcessName: 442.docx.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.90.147.125, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Initiated: true, ProcessId: 7864, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49804

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5736, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Remote Admin Backdoor Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T08:47:38.233328+0100	2849354	1	Malware Command and Control Activity Detected	192.168.2.5	49803	111.90.147.125	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC345A0 rmsEncInitSimpleEncryption,memcpy,memcpy,	12_2_5FC345A0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC33760 rmsEncEncryptData,	12_2_5FC33760
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC33D30 rmsEncRsaPrivateDecrypt,memcpy,memcpy,memcpy,	12_2_5FC33D30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC338C0 rmsEncDecryptData,	12_2_5FC338C0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC342D0 rmsEncRsaPrivateEncrypt,memcpy,memcpy,memcpy,	12_2_5FC342D0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC33AE0 rmsEncRsaPublicEncrypt,memcpy,	12_2_5FC33AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FC34000 rmsEncRsaPublicDecrypt,memcpy,memcpy,memcpy,	12_2_5FC34000

Source: rfusclient.exe, 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_0ea94acd-6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 12.2.rfusclient.exe.c70000.0.unpack

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 442.docx.exe, 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmp, 442.docx.exe, 00000000.00000000.2026361763.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C99B40BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C99CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99DFCA0 FindFirstFileExA,	0_2_00007FF7C99DFCA0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	12_2_5FFF6B90
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	12_2_5FFF6AD0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then sub esp, 1Ch	12_2_5FFFBEB0

Source: winword.exe

Memory has grown: Private usage: 1MB later: 91MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2849354 - Severity 1 - ETPRO MALWARE Remote Admin Backdoor Related Activity : 192.168.2.5:49803 -> 111.90.147.125:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 111.90.147.125 ports 5651,1,465,5,6,55555,80

Source: global traffic	TCP traffic: 192.168.2.5:49802 -> 111.90.147.125:5651
Source: global traffic	TCP traffic: 192.168.2.5:49805 -> 78.138.9.142:5651
Source: global traffic	TCP traffic: 192.168.2.5:49823 -> 95.213.205.83:5655
Source: global traffic	TCP traffic: 192.168.2.5:49842 -> 109.234.156.179:5655

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125

Source: global traffic

DNS traffic detected: DNS query: id72.internetid.ru

Source: svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260648618.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127361397.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289097781.00000225E3976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2260648618.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000B.00000002.3312868171.00000225E405D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3313054301.00000225E408B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicer
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2982270718.0000000000788000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/G
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: rutserv.exe, 00000011.00000003.2981074132.0000000007264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlL
Source: rutserv.exe, 00000011.00000003.2979233935.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl
Source: rutserv.exe, 00000011.00000002.3360847258.00000000072C6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2980151820.00000000072CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl/
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: rutserv.exe, 00000011.00000003.2979233935.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlCo.
Source: rutserv.exe, 00000011.00000003.2979233935.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlN
Source: rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlO
Source: rutserv.exe, 00000011.00000003.2979233935.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlP
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com:80/gsgccr45codesignca2020.crlw
Source: svchost.exe, 00000006.00000002.3315438918.00000150A4010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2982270718.0000000000788000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309654301.00000225E390F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2360021197.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2334960702.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2444894768.00000225E392F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2318378237.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289097781.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289527010.00000225E390E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2334351248.00000225E3977000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2334960702.00000225E3979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd%
Source: svchost.exe, 0000000B.00000003.2260420296.00000225E390E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd0
Source: svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 0000000B.00000003.2168247282.00000225E3955000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdxmlns:
Source: svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309654301.00000225E390F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2360021197.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2288569554.00000225E3929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2334960702.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2318378237.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289097781.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289527010.00000225E390E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 0000000B.00000003.2364814470.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000B.00000003.2168247282.00000225E3955000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdst=
Source: svchost.exe, 0000000B.00000002.3312588974.00000225E403B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: svchost.exe, 0000000B.00000002.3311853387.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/22otificationses
Source: svchost.exe, 0000000B.00000002.3311853387.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-u
Source: svchost.exe, 00000006.00000003.2086757016.00000150A3EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: rfusclient.exe, 0000000C.00000000.2170437757.0000000000CBF000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2311900213.000000007B910000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2982270718.0000000000788000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3351298149.0000000003D80000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: rutserv.exe, 00000011.00000002.3303616204.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2979233935.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45http://crl.globalsign.com/codesigningrootr45.crl
Source: rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020
Source: rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2
Source: rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCUABBTLuA3ygnKW%2F7xuSx%2F0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020http://crl.globalsign.com/gsgccr45codesignca2020.cr
Source: rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020t.n
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: rutserv.exe, 00000011.00000002.3303616204.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2979233935.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr3http://crl.globalsign.com/root-r3.crlT/
Source: svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312588974.00000225E403B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/;
Source: rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000002.3352551373.0000000004050000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3352551373.000000000413F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/nsys.ru/pf
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/pf
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/rd
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/
Source: rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/D
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: svchost.exe, 0000000B.00000003.2445114928.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309654301.00000225E390F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: 442.docx.exe, 00000000.00000003.2051892599.000001B53872D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, rfusclient.exe, 0000000C.00000000.2170437757.0000000000CBF000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2311900213.000000007B910000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2288569554.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policye.srf
Source: svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scerence
Source: svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scst
Source: svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee1
Source: svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuessue
Source: svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustce
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: rutserv.exe, 00000011.00000002.3303616204.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2979233935.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt1.3.6.1.5.5.7.48.1http://ocsp.globalsi
Source: rutserv.exe, 00000011.00000002.3303616204.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2979233935.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crtv
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade.ini
Source: rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade_beta.ini
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 0000000C.00000000.2170437757.00000000014CB000.00000020.00000001.01000000.0000000B.sdmp, rfusclient.exe, 0000000C.00000003.2185022388.0000000001B05000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000E.00000003.2243256163.0000000004255000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000001511000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000F.00000003.2274258179.00000000041D5000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2343735575.0000000002645000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E3077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E3077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/i
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125658502.00000225E3957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: rfusclient.exe, 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000006.00000003.2086757016.00000150A3F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.2086757016.00000150A3EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: rutserv.exe, 0000000E.00000002.2258557114.000000006025F000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugsrg/bugs/):
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312588974.00000225E403B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3307156538.00000225E313C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000B.00000003.2259782633.00000225E403D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExis
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExisrf?u
Source: svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502logi
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600:Inl
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601ient
Source: svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf%
Source: svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfs
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srfP
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3091000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312868171.00000225E405D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E308E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E30F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2419640428.00000225E30F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf-asc
Source: svchost.exe, 0000000B.00000002.3306275033.00000225E30F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfTs
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/pp
Source: svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppse
Source: svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsech
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srfin.live.
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000B.00000003.2126273573.00000225E3927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfuera
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E3927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfManage
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf://acco
Source: svchost.exe, 0000000B.00000003.2126273573.00000225E3927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srfice
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfleteAcc
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600gi
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125904317.00000225E396B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfue
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125658502.00000225E3957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125346792.00000225E395A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfteAc
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000000B.00000003.2125263594.00000225E304F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3313007133.00000225E407E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000B.00000002.3313007133.00000225E407E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 0000000B.00000002.3307156538.00000225E313C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comwwCP=
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.micr
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf%
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000B.00000003.2126273573.00000225E3927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.micrtonl
Source: svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logive.c
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST
Source: rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access/
Source: rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/
Source: rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/O
Source: svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/about/privacy-policy.php
Source: rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/buy/money-back-guarantee.php
Source: rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/installing-and-uninstalling/

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.0.rfusclient.exe.c70000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99AC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C99AC2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c8461.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8991.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8ADA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c8464.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c8464.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A62E94087F64223B9812F11186592BA
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI8991.tmp

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99AF930	0_2_00007FF7C99AF930
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B4928	0_2_00007FF7C99B4928
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99A5E24	0_2_00007FF7C99A5E24
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99CCE88	0_2_00007FF7C99CCE88
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C1F20	0_2_00007FF7C99C1F20
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99CB190	0_2_00007FF7C99CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BA4AC	0_2_00007FF7C99BA4AC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C3484	0_2_00007FF7C99C3484
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D0754	0_2_00007FF7C99D0754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99A1AA4	0_2_00007FF7C99A1AA4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C2AB0	0_2_00007FF7C99C2AB0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99E5AF8	0_2_00007FF7C99E5AF8
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B1A48	0_2_00007FF7C99B1A48
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99DFA94	0_2_00007FF7C99DFA94
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D89A0	0_2_00007FF7C99D89A0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C3964	0_2_00007FF7C99C3964
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BC96C	0_2_00007FF7C99BC96C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D8C1C	0_2_00007FF7C99D8C1C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C4B98	0_2_00007FF7C99C4B98
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BBB90	0_2_00007FF7C99BBB90
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B5B60	0_2_00007FF7C99B5B60
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C8DF4	0_2_00007FF7C99C8DF4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D0754	0_2_00007FF7C99D0754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C2D58	0_2_00007FF7C99C2D58
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99E2080	0_2_00007FF7C99E2080
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BAF18	0_2_00007FF7C99BAF18
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99AA310	0_2_00007FF7C99AA310
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99AC2F0	0_2_00007FF7C99AC2F0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99A7288	0_2_00007FF7C99A7288
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B126C	0_2_00007FF7C99B126C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C21D0	0_2_00007FF7C99C21D0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BF180	0_2_00007FF7C99BF180
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99C53F0	0_2_00007FF7C99C53F0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99A76C0	0_2_00007FF7C99A76C0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99E2550	0_2_00007FF7C99E2550
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99BB534	0_2_00007FF7C99BB534
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99A4840	0_2_00007FF7C99A4840
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99DC838	0_2_00007FF7C99DC838
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFDCBD0	12_2_5FFDCBD0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_6009E260	12_2_6009E260
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_60077080	12_2_60077080
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFE5AE0	12_2_5FFE5AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FCE6850	12_2_5FCE6850
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFDD620	12_2_5FFDD620
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFDDC00	12_2_5FFDDC00
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFE5800	12_2_5FFE5800

Source: unires_vpd.dll.3.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: rutserv.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.3.dr	Static PE information: Resource name: MAD type: DOS executable (COM, 0x8C-variant)
Source: rfusclient.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unidrvui_rppd.dll0.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unires_vpd.dll0.3.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: rutserv.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: libcodec32.dll.3.dr	Static PE information: Number of sections : 20 > 10
Source: libasset32.dll.3.dr	Static PE information: Number of sections : 19 > 10

Source: unires_vpd.dll.3.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll0.3.dr	Static PE information: No import functions for PE file found

Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C5D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C65E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C71B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C6B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 442.docx.exe

Source: 12.0.rfusclient.exe.c70000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll.3.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll0.3.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal92.troj.evad.winEXE@28/328@1/5

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99AB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7C99AB6D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99C8624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF7C99C8624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1eb8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1ccc
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$1eb8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1ef8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f20
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e0c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f14
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1d44
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e98
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f20
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$c40
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f14

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF1824809D33FF74D6.TMP

Jump to behavior

Source: 442.docx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rfusclient.exe	String found in binary or memory: ENGINESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3"
Source: rfusclient.exe	String found in binary or memory: MODULESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules"
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Users\user\Desktop\442.docx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\442.docx.exe "C:\Users\user\Desktop\442.docx.exe"
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 684489E62C864DF5C283E9DB67C8FC1A
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 684489E62C864DF5C283E9DB67C8FC1A	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\Desktop\442.docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Doc.LNK.4.dr

LNK file: ..\..\..\..\..\..\..\intel\Doc.docx

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: 442.docx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 442.docx.exe

Static file information: File size 25141051 > 1048576

Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 442.docx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 12.2.rfusclient.exe.c70000.0.unpack

Source: C:\Users\user\Desktop\442.docx.exe

File created: C:\intel\__tmp_rar_sfx_access_check_5012343

Jump to behavior

Source: 442.docx.exe	Static PE information: section name: .didat
Source: 442.docx.exe	Static PE information: section name: _RDATA
Source: vp8encoder.dll.3.dr	Static PE information: section name: .rodata
Source: vp8decoder.dll.3.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.3.dr	Static PE information: section name: _RDATA
Source: libasset32.dll.3.dr	Static PE information: section name: /4
Source: libasset32.dll.3.dr	Static PE information: section name: /14
Source: libasset32.dll.3.dr	Static PE information: section name: /29
Source: libasset32.dll.3.dr	Static PE information: section name: /41
Source: libasset32.dll.3.dr	Static PE information: section name: /55
Source: libasset32.dll.3.dr	Static PE information: section name: /67
Source: libasset32.dll.3.dr	Static PE information: section name: /78
Source: libasset32.dll.3.dr	Static PE information: section name: /94
Source: libasset32.dll.3.dr	Static PE information: section name: /110
Source: eventmsg.dll.3.dr	Static PE information: section name: .didata
Source: webmvorbisencoder.dll.3.dr	Static PE information: section name: _RDATA
Source: libcodec32.dll.3.dr	Static PE information: section name: .rodata
Source: libcodec32.dll.3.dr	Static PE information: section name: /4
Source: libcodec32.dll.3.dr	Static PE information: section name: /14
Source: libcodec32.dll.3.dr	Static PE information: section name: /29
Source: libcodec32.dll.3.dr	Static PE information: section name: /41
Source: libcodec32.dll.3.dr	Static PE information: section name: /55
Source: libcodec32.dll.3.dr	Static PE information: section name: /67
Source: libcodec32.dll.3.dr	Static PE information: section name: /78
Source: libcodec32.dll.3.dr	Static PE information: section name: /94
Source: libcodec32.dll.3.dr	Static PE information: section name: /110
Source: vccorlib120.dll.3.dr	Static PE information: section name: minATL
Source: rutserv.exe.3.dr	Static PE information: section name: .didata
Source: rfusclient.exe.3.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.3.dr	Static PE information: section name: minATL

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99E5156 push rsi; retf	0_2_00007FF7C99E5157
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99E5166 push rsi; retf	0_2_00007FF7C99E5167
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 12_2_5FFF7E30 push eax; mov dword ptr [esp], esi	12_2_5FFF7ED1
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Code function: 17_2_0101C34B push ebx; ret	17_2_0101C354

Source: msvcr120.dll.3.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: VPDAgent.exe.3.dr	Static PE information: section name: .text entropy: 6.812931691200469

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8991.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8991.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.exe

Static PE information: 442.docx.exe

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer Security

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 0000000E.00000000.2203086600.0000000001511000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000E.00000002.2248570000.0000000002788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000010.00000002.2364038786.00000000023F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE
Source: rutserv.exe, 00000010.00000002.2364038786.00000000023F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEDJ

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Window / User API: threadDelayed 1366
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Window / User API: threadDelayed 5542
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Window / User API: threadDelayed 6034
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Window / User API: threadDelayed 3455

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8991.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_12-6229

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

API coverage: 5.8 %

Source: C:\Windows\System32\svchost.exe TID: 3568	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7896	Thread sleep count: 81 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7896	Thread sleep time: -81000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7924	Thread sleep time: -50000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7944	Thread sleep time: -35000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7988	Thread sleep time: -240000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8008	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7964	Thread sleep count: 1366 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8128	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 5036	Thread sleep count: 45 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7896	Thread sleep count: 5542 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7896	Thread sleep time: -5542000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe TID: 7252	Thread sleep time: -3017000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe TID: 7252	Thread sleep time: -1727500s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99B40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C99B40BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C99CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99DFCA0 FindFirstFileExA,	0_2_00007FF7C99DFCA0

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99D16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF7C99D16A4

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 50000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000

Source: rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT*
Source: svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTcpV6VMWare
Source: svchost.exe, 00000006.00000002.3315800908.00000150A4058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3305630779.00000225E30D7000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2982524280.0000000007280000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.0000000007270000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3297940665.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3359972532.0000000007280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000006.00000002.3305641563.000001509EA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: rfusclient.exe, 0000000C.00000002.2187015900.00000000019ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99D3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7C99D3170

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99E0D20 GetProcessHeap,

0_2_00007FF7C99E0D20

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C99D3170
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7C99D2510
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D3354 SetUnhandledExceptionFilter,	0_2_00007FF7C99D3354
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7C99D76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C99D76D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C99CB190

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior

Source: rfusclient.exe, 0000000C.00000000.2170437757.0000000000CBF000.00000020.00000001.01000000.0000000B.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99BDC70 cpuid

0_2_00007FF7C99BDC70

Source: C:\Users\user\Desktop\442.docx.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF7C99CA2CC

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99D0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C99D0754

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7C99B4EB0 GetVersionExW,

0_2_00007FF7C99B4EB0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: rutserv.exe, 0000000E.00000000.2203086600.0000000001511000.00000020.00000001.01000000.0000000D.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 0000000E.00000002.2248570000.0000000002788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Blob

Jump to behavior

Source: Yara match	File source: 12.0.rfusclient.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.3309338966.0000000003858000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3320249204.0000000005420000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3304532933.000000000206A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3304532933.0000000002046000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3309338966.000000000388A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3320249204.0000000005464000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	13 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	67 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	121 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	4%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	8%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	13%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	12%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI8991.tmp	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
main.internetid.ru	0%	Virustotal		Browse
id72.internetid.ru	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	0%	Avira URL Cloud	safe
https://login.micr	0%	Avira URL Cloud	safe
http://rmansys.ru/pf	0%	Avira URL Cloud	safe
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	0%	Avira URL Cloud	safe
https://logive.c	0%	Avira URL Cloud	safe
http://rmansys.ru/nsys.ru/pf	0%	Avira URL Cloud	safe
https://www.remoteutilities.com/about/privacy-policy.php	0%	Avira URL Cloud	safe
http://rmansys.ru/web-help/	0%	Avira URL Cloud	safe
http://rmansys.ru/rd	0%	Avira URL Cloud	safe
http://rmansys.ru/web-help/eb-help/	0%	Avira URL Cloud	safe
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	0%	Avira URL Cloud	safe
https://login.micrtonl	0%	Avira URL Cloud	safe
https://www.remoteutilities.com/buy/money-back-guarantee.php	0%	Avira URL Cloud	safe
http://rmansys.ru///rmansys.ru/;	0%	Avira URL Cloud	safe
http://rmansys.ru///rmansys.ru/	0%	Avira URL Cloud	safe
http://rmansys.ru/web-help/eb-help/D	0%	Avira URL Cloud	safe
http://rmansys.ru/	0%	Avira URL Cloud	safe
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	1%	Virustotal		Browse
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
main.internetid.ru	95.213.205.83	true	false	0%, Virustotal, Browse	unknown
prod.globalsign.map.fastly.net	151.101.130.133	true	false		high
id72.internetid.ru	unknown	unknown	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://update.tektonit.ru/upgrade.ini	rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd0	svchost.exe, 0000000B.00000003.2260420296.00000225E390E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.2086757016.00000150A3EC0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.microsoft.c	442.docx.exe, 00000000.00000003.2051892599.000001B53872D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	rfusclient.exe, 0000000C.00000000.2170437757.00000000014CB000.00000020.00000001.01000000.0000000B.sdmp, rfusclient.exe, 0000000C.00000003.2185022388.0000000001B05000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000E.00000003.2243256163.0000000004255000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000001511000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000F.00000003.2274258179.00000000041D5000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2343735575.0000000002645000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/internet-id/	rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000002.3352551373.0000000004050000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3352551373.000000000413F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://login.micr	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 0000000B.00000003.2364814470.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policye.srf	svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.flexerasoftware.com0	442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	442.docx.exe, 00000000.00000003.2038083286.000001B53C57C000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://Passport.NET/tb_	svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3313054301.00000225E408B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.live	svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdst=	svchost.exe, 0000000B.00000003.2168247282.00000225E3955000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 0000000B.00000003.2419640428.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3306275033.00000225E3102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125658502.00000225E3957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.or	svchost.exe, 0000000B.00000002.3304526585.00000225E3077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3315438918.00000150A4010000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3312588974.00000225E403B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/pf	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf	svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdxmlns:	svchost.exe, 0000000B.00000003.2168247282.00000225E3955000.00000004.00000020.00020000.00000000.sdmp	false		high
https://logive.c	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://www.symauth.com/rpa00	442.docx.exe, 00000000.00000003.2038083286.000001B53C64C000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.2038083286.000001B53C60E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuessue	svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.ecur	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/nsys.ru/pf	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.remoteutilities.com/about/privacy-policy.php	rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru/web-help/	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.mi	svchost.exe, 0000000B.00000003.2445114928.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309654301.00000225E390F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustce	svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee1	svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://madExcept.comU	rfusclient.exe, 0000000C.00000000.2170437757.0000000000CBF000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2311900213.000000007B910000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000000B.00000002.3312472664.00000225E4013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, rfusclient.exe, 0000000C.00000000.2170437757.0000000000CBF000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2311900213.000000007B910000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/rd	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru/web-help/eb-help/	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 0000000B.00000003.2260759594.00000225E3969000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260648618.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2260920520.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127361397.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID	svchost.exe, 0000000B.00000002.3312588974.00000225E403B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/22otificationses	svchost.exe, 0000000B.00000002.3311853387.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.	svchost.exe, 0000000B.00000002.3304526585.00000225E3077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugsrg/bugs/):	rutserv.exe, 0000000E.00000002.2258557114.000000006025F000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf%	svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/	rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	rutserv.exe, 00000011.00000002.3317620536.00000000020EE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/i	svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.micrtonl	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb	svchost.exe, 0000000B.00000003.2260648618.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309654301.00000225E390F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2360021197.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2288569554.00000225E3929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2334960702.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2318378237.00000225E390E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289097781.00000225E3976000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289527010.00000225E390E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2289097781.00000225E3976000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	svchost.exe, 0000000B.00000003.2126273573.00000225E3927000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/buy/money-back-guarantee.php	rfusclient.exe, 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.2328361611.0000000006C2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru///rmansys.ru/;	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cacerts.digicer	rutserv.exe, 00000011.00000002.3359972532.000000000728A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2981074132.000000000728A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru///rmansys.ru/	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2288569554.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	rfusclient.exe, 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000E.00000002.2258557114.0000000060247000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 0000000B.00000003.2260338207.00000225E3929000.00000004.00000020.00020000.00000000.sdmp	false		high
http://update.tektonit.ru/upgrade_beta.ini	rutserv.exe, 0000000E.00000000.2203086600.0000000000B11000.00000020.00000001.01000000.0000000D.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000B.00000003.2127172153.00000225E392A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000B.00000002.3303786936.00000225E302B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125320391.00000225E3910000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scst	svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2319478531.00000225E3952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418909334.00000225E3076000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2168505928.00000225E3953000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/web-help/eb-help/D	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000006.00000003.2086757016.00000150A3F33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 0000000B.00000002.3304526585.00000225E305F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2126273573.00000225E392C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2127219002.00000225E3956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125380247.00000225E3952000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 0000000B.00000003.2359941655.00000225E396E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311154783.00000225E3937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3311304617.00000225E395F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3309861822.00000225E3913000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000B.00000003.2125747666.00000225E3963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125578153.00000225E393B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3304172341.00000225E3040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2125682030.00000225E3940000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd%	svchost.exe, 0000000B.00000003.2334351248.00000225E3977000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2334960702.00000225E3979000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-u	svchost.exe, 0000000B.00000002.3311853387.00000225E3979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2445200328.00000225E3978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2418338685.00000225E3978000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/	rutserv.exe, 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
111.90.147.125	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
109.234.156.179	unknown	Russian Federation	49505	SELECTELRU	false
78.138.9.142	unknown	United Kingdom	8513	SKYVISIONGB	false
95.213.205.83	main.internetid.ru	Russian Federation	50340	SELECTEL-MSKRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567177
Start date and time:	2024-12-03 08:46:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	442.docx.exe renamed because original name is a hash value
Original Sample Name:	.docx.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@28/328@1/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.68.129, 52.113.194.132, 20.190.177.82, 20.190.177.83, 20.190.177.23, 20.190.147.4, 20.190.147.10, 20.190.177.146, 20.190.147.8, 20.190.147.0, 2.19.198.65, 23.32.238.121, 2.19.198.57, 23.32.238.113, 23.32.238.154, 2.19.198.41, 23.32.238.152, 52.111.252.15, 52.111.252.17, 52.111.252.16, 52.111.252.18, 23.218.208.109, 52.182.143.213, 2.17.100.216, 2.17.100.200, 2.17.100.210, 2.17.100.232, 2.17.100.152, 23.32.238.105, 23.32.238.128, 23.32.238.99, 23.32.238.129, 23.32.238.138, 23.32.238.115, 23.32.238.122, 23.32.238.98, 104.18.21.226, 104.18.20.226, 151.101.130.133
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, onedscolprdcus16.centralus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, wu-b-net.trafficmanager.net, ecs.office.com, fs.microsoft.com, prod-inc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, nleditor.osi.office.net, s-0005.s-msedge.net, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net, binaries.templates.cdn.office.net.edgesuite.net, cdn.globalsigncdn.com.cdn.cloudflare.net, templatesmetadata.office.net.edgekey.net, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.ak
Execution Graph export aborted for target rutserv.exe, PID 7492 because there are no executed function
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:10	API Interceptor	2x Sleep call for process: svchost.exe modified
02:47:32	API Interceptor	380619x Sleep call for process: rutserv.exe modified
02:47:38	API Interceptor	112613x Sleep call for process: rfusclient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.213.205.83	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.globalsign.map.fastly.net	https://e.letscompress.online/update.txt	Get hash	malicious	Unknown	Browse	151.101.130.133
	http://propdfhub.com	Get hash	malicious	Unknown	Browse	151.101.130.133
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	151.101.194.133
	goJ2miRnrv.exe	Get hash	malicious	RMSRemoteAdmin	Browse	151.101.194.133
	goJ2miRnrv.exe	Get hash	malicious	RMSRemoteAdmin	Browse	151.101.66.133
	https://www.pdfriend.com/pdfconverter?gad_source=5&gclid=EAIaIQobChMIwqGhsbi9iAMVO6uOCB1oKCEPEAEYASAAEgJbhfD_BwE	Get hash	malicious	Unknown	Browse	151.101.2.133
	http://ak43423ce23ks.com/qnbfinans/	Get hash	malicious	Unknown	Browse	151.101.2.133
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	151.101.2.133
	https://firebasestorage.googleapis.com/v0/b/namo-426715.appspot.com/o/PqA45bE7me%2FForm_Ver-11-58-52.js?alt=media&token=dc88189e-81de-49e9-879e-365bc76e3567	Get hash	malicious	BruteRatel, Latrodectus	Browse	151.101.130.133
	Form_W-9_Ver-083_030913350-67084228u8857-460102.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	151.101.130.133
main.internetid.ru	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172
	invoice-6483728493.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	PI-02911202409#.xla	Get hash	malicious	Unknown	Browse	199.232.210.172
	V-Mail.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	199.232.214.172
	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYVISIONGB	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	83.229.59.112
	https://www.google.ml/url?fvg=1YI3fC8whlGPBCiMyiuQ&bhtBf=8EQhXbuMThqowIo0zyCX&sa=t&ndg=afydNw3nDHf9A6uq2MCH&url=amp%2Fiestpcanipaco.edu.pe%2F.r%2Fu1kOgE-SURELILYYWRhcnNoLm1hbGhvdHJhQGphdG8uY29t	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	arm4.elf	Get hash	malicious	Mirai	Browse	217.194.146.92
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	217.194.158.58
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	83.229.19.82
	https://bread.nfpt.adfixagency.co.in/	Get hash	malicious	Unknown	Browse	78.138.9.37
	https://bread1.nfpt.adfixagency.co.in/landingv2	Get hash	malicious	Unknown	Browse	78.138.9.37
	https://www.google.com/url?q=https://www.google.com/url?q%3DIrfT8NMLx6QPaJgv6Z3g%26rct%3DqsUbQmXhZ93d4gNXIWaR%26sa%3Dt%26esrc%3DEgJeLX8CAl11DNSW7pgH%26source%3D%26cd%3D9X3EYbyCMUoB46Jqpszn%26cad%3Dz64Ndl7J844jI5EH33et%26ved%3D36LRX1krI3rPMEZVSMU2%26uact%3D%2520%26url%3Damp%252Fsantanderconcepts%252Ecom%252F.lamb%252F&source=gmail&ust=1725986149001000&usg=AOvVaw1kdi6SPX1NGpGYFWhG_1Z7#NQvlKnUGFE-SURENICObWljaGFlbHNjb2ZpZWxkQGRpc25leS5jb20=	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	payload_x86.ps1	Get hash	malicious	Metasploit	Browse	83.229.120.79
	Shipping document_pdf.exe	Get hash	malicious	FormBook	Browse	83.229.122.241
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	101.99.75.104
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	111.90.149.151
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	111.90.141.53
	Ssc Executed Docs#962297(Revised).docx	Get hash	malicious	Unknown	Browse	111.90.146.230
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	101.99.125.192
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	124.217.225.17
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
SELECTELRU	nabppc.elf	Get hash	malicious	Unknown	Browse	85.119.147.53
	6X4BIzTTBR.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.37
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.37
	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.177
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	176.113.115.203
	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse	176.113.115.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe	Get hash	malicious	RMSRemoteAdmin	Browse

Created / dropped Files

C:\Config.Msi\4c8463.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	33259
Entropy (8bit):	5.289535231253926
Encrypted:	false
SSDEEP:	768:o5t4t4t+ZXTWBwp1KwUXciM01HuECHgCg4gcgblFl/Y3TY3s8:fCBwpswUXceHuECHgCg4gcgblFlA3U3j
MD5:	FF11C839ABDDBD0E3DC73BA280650AB8
SHA1:	12DAF274E6C96335F908033C8C365ACA271CF60F
SHA-256:	04E9CF716E8342AFC1845194B6351377CBAF0B07F9206634C4D7FA5A47657C53
SHA-512:	B6D507825A46F7759F536D004B1E7E5421CABC80BB09D17883C750117842E41E320E89A716D49DD9448AB482F83BAAE48BFC531F94C8AE02B880D5D3B145EEE2
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.].....ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2...&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{3244CD

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	140524
Entropy (8bit):	4.705761523836363
Encrypted:	false
SSDEEP:	768:wu3K4JDvJNJt2cGTXxl5loUWDTEhkClEgoKt9ai1IYdO5NVSUeDfydxqXJe2JNC0:wu93dN2OqrYZlKhIiSEGQ4wL
MD5:	65B04B706AC06E31210F4FFB1E92994E
SHA1:	B005637B3DE903CBD7960637D77FF993897C5A63
SHA-256:	E9ACC22A02BC2148AE07EC7CBE741E6E1CBC90DE3856AAE8F32A31FB5C338566
SHA-512:	5B708D069434A384738EFD5F4621F257FC79A7F5A32D8AE9C1D29E21EFE1EEB2C393EC67DA39714C0C73F2217B68091EE7196C72331838A0A7ECA872FAF09A09
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0204

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.579534230870796
Encrypted:	false
SSDEEP:	192:XxgSABvdm4Yy3EA39QKoEp0Fm7qFAmL8x2fLWwsU7K6CYv7+C:Xx0FmW3Ea1KmexmMK6jr
MD5:	C2F009D6317D1BA4E722938A1408478A
SHA1:	66D702BC9FA98D1E7FE9BBC16AFF9AE711019E9B
SHA-256:	6A8D4FB6F90B53D986B2AC6BF3BFCC56D6A54A2E8AF5670129566F5D344ED0FA
SHA-512:	4D8060EC77EB9B95B57BC20AF2685064FA1E1FCC9403EFE95572C37D72ACD39B8005831EA0BAE95C365E945E50962B7FE1BFD964C5776D3E99CE5E474F726BFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: 044f.pdf.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse Filename: 3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......J....@.................................."..x....@..................@....P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2673984
Entropy (8bit):	6.865614554810881
Encrypted:	false
SSDEEP:	49152:BE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeF8:BE8XHX5riUl7wDP6vQ/qpyr0kR5XLWDB
MD5:	10CD2135C0C5D9D3E5A0A5B679F2FAAE
SHA1:	A0617D8C6876F98B9A1819A71F2A56B965C1C75D
SHA-256:	D7A97387505CA740AC88E85CAC3AA3CA73C666CC3BFD977C7E40B1D9D6CA6C12
SHA-512:	6A1F81127FF26DCC235D7CE454E69F9A3784AC54BBC8486CB5022AAC47C2FB6003641A0F8AAFDD3B89812FE3C1C90569AD73C1C135687C042CE92C5DD2FFBDD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L...h3.\............................5u............@.......................... ).......(...@.................................<.&.......'.H.............(.@.....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1110848
Entropy (8bit):	6.491478844569486
Encrypted:	false
SSDEEP:	24576:TqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzb:tQSX0oAtkpf/bfcyTTmoozb
MD5:	AB3E77FC94445A18C9376F98CE10102F
SHA1:	9424736FB3DB517C5584A14A482F84D81A671F8D
SHA-256:	EEE325D9AC6A7B24B8ED3742110BD042803D6DA065F2E51153151E69D51CE4A3
SHA-512:	454115C621434E98D39AEC605FCEB349C7AFB938B3E822F5950EE60E54FBFCB5CDBFE750015FE947C07FB991B4E966E535640343294D885ED2661353D3FD6EC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d.......................@........l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.464002114523214
Encrypted:	false
SSDEEP:	384:2+b57Gk7g+iy21oCiDuK9jkrtpgjKMpFmexmMK6j8qF2:7/210DuVrtsKM3ZxBKghF2
MD5:	2DE35EAAE57A6BAA02D9E8ED0661F042
SHA1:	82D14A58D5188F5B7606365BE0E3F968A8E81E93
SHA-256:	BB43036D202D3DBD765A12D1C4C243E7AB8328FFC1941AEA838D8B1553700E64
SHA-512:	02F1D530C1469431A94074A057FCE3FE60735D3B15DD767E8F39F29B702B98B061954063D83D5FA426D7684CC86359E87424F0CC54FFB0AC3F388AA7E48D6DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L...k3.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:..@....p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4005696
Entropy (8bit):	6.809616089473951
Encrypted:	false
SSDEEP:	98304:lbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FAK:FR+lDOt5kgFvVwmd
MD5:	2C5987EA1E87A5C073B780F8102AE09C
SHA1:	78DAA99D8C59A4A2E0D3B59E5427F854D8613080
SHA-256:	22AC34380064C0FFEE59AD892CA4695E94EE8F97B78C18565251295817A784FE
SHA-512:	7D6432960C5F3BEC27B13D06D4126C91A1DD7DD702DE97F1001855D8572BE68D6526F419BB58F5E5238E8E8F81C801BDAD8F351EF0AE75564835146F3DD3434D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.....3.=...@.........................pA:......p:.d.....;...............=.@.....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39744
Entropy (8bit):	6.36744082696392
Encrypted:	false
SSDEEP:	384:TkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQzUQ9LSk3E0gTSsn2TkhI3K0Jn:TLqokSaddQzUNk3EXSsn2Tk4ZZxBKgfP
MD5:	9ED8BAA9DEC76C6AFAFC1C71193A0AE8
SHA1:	843727F195BF194CFF3736B80FB5249713F1E116
SHA-256:	CD2C60402D46C339147ADDF110C904F78A783F23106CCAD147EFA156175D66DE
SHA-512:	40D85540176AB0170B7341D6A8A808FD351B35C6444D468E7707B35D2B2E8F3322DBF0BF31E0578E3A12E1A62B310DD7983B7EFB0F2C72D0C4104AEB0BBCEFF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L....3.\.................D...8.......I.......`....@.......................................@..................................s.......................\|..@............b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179520
Entropy (8bit):	5.239011393842513
Encrypted:	false
SSDEEP:	1536:+vQrKBVxKfGkHM5ZZ+HHJOWfuXO8zIJ1k9XHX8t0wk7UAjKQpmErUaDO3nG:3kjiTGD+JOWGT00XHXo0w+mErBO3G
MD5:	FF197487BFE7E9D3396E0793B83811ED
SHA1:	D92CA066B79DF28BF22BB051AEDFE10E4FA4A2A6
SHA-256:	E6D0CA844514FDD105772E72C7C30D47099112AB68A4A5F9E4A2B28C0372A05A
SHA-512:	33A13B0EE7E3DD038B35B5E4220278016397D003DCEECA56C3EE264608E053940AAFC09AE582C0FD67DFA919F38265883269F6C1A93E5BB9047B97F4A51CACCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L....3.\.................\..........8........p....@..........................0......T.....@.................................,5.......`..V...............@....... ....z..8...........................(...@............0..,............................text....[.......\.................. ..`.rdata...D...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53056
Entropy (8bit):	6.556803642202102
Encrypted:	false
SSDEEP:	768:AqfYixknAt1kJSwlxeZQHPFtuEK+XLxSzELK4ZHZxBKgCu:8ixknqaxxeZ09tVr7xkyZ5ncu
MD5:	A7A19BFD82EEAE7D4DC00144F3B949F4
SHA1:	FBD6EF10A7D519386CB32B093AE7E42852BAECBD
SHA-256:	A32A93B71A5628EDFC19FD31D26AC60DAF364E89CFDA2C82071718814042BE55
SHA-512:	5AC0F6A0FDAAB8B832B0021948101ABD1C8AF8B79E0C02D60770DF22D945D669AE7D588BD3264F9991E11CBAB01A445AAC9B594B47171C68A6A7BDC3FBB8D962
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L...j3.\.................v...:......Ez............@.................................Ul....@.................................t...x.......@...............@...............8..............................@...............\|............................text....u.......v.................. ..`.rdata... ......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772288
Entropy (8bit):	6.917291195041145
Encrypted:	false
SSDEEP:	49152:UuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChRebU:UuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpj
MD5:	9FD469846E628F44A4147743875FFBC0
SHA1:	6065C496D7C2695F3678D945FFA3FEFFBCD83C53
SHA-256:	129C2D91F085E54FD9E333C6F580A16907A1D9659D823D6C7CB25F5D3CE55CC8
SHA-512:	5AF5DD95BE604E039337D153CED2B9D3FE33F2E05818E3A222FDD9F7B3381197CCF3CA39324F46CA95B81DF76624F0EF4A0CF045195640E58B9A233D092F43AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... ....................................N....@.........................p.'..:..T.(.......)...............*.@.....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2991424
Entropy (8bit):	6.7900679594310915
Encrypted:	false
SSDEEP:	49152:kz1BQT/9rrcXgJoHt3LhNSTuHo6E7hVNO8B/3LUvQ/qpyr0kRZTKjEKMUP9isAxI:kz1BI5U3lNS6Ho6E7vBRIvQ/qpyr0kuF
MD5:	829DD10CD377386A2040897F5288DDB0
SHA1:	A7B1C7A6C0E1C9641750E8150EE810530FB67DD0
SHA-256:	5753F66DBC480901955DE247117F3C1E99777B1A610C90931E50C374F8B1D888
SHA-512:	C6B915EBF7B1C023FBB2E06FB169857539253CFA2B5B5C770DF5A43896AF8A0C847796E3F82C6109778F11D7FE3976DA172E1E0E6EACCD1C82DBAEB80ADAB4F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L....3.\..................!...........!......."...@...........................-.....;.....@...........................+.+.....+.......,.@.............-.@.....,..C...................................w+.@............."..............................text...g.!.......!................. ..`.rdata..$.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35648
Entropy (8bit):	6.365966080243848
Encrypted:	false
SSDEEP:	768:nE2YHORRn1SNBaiAL3X8jARHb2Os7fAK6ncZxBKg1xDo:E862HbPs7otEnzNo
MD5:	68EA0EC529B7B9D3284D860F5ABD9BB4
SHA1:	1A3951538D9E79F09792C8B118F010834A6C1273
SHA-256:	EE963C5960F6687789004175C3DF0098331BEBBCE992BF9C73EF9EF6ED73C1E0
SHA-512:	E62D2CFCA2433F4D647A5658141D63093D75491C60D1647F41FFDE74308BDF1A512DEBCC4A4535CE6FC9DE1ACB149D135D89366FE75FC9C52AA709C8887D7A28
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d....4.\.........." .....V..........\|P....................................................@..........................................d..W....[..................`....l..@........... ................................................................................text...'U.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204096
Entropy (8bit):	5.820956822859452
Encrypted:	false
SSDEEP:	3072:co2/UxSJBXgK5IsZsYMNV7jWCQQD9KdtvB1WOAahmRF:co284/XgGfbuYAKdf1WOAaO
MD5:	126C2BCC9112266CE33F9835A1E44B9C
SHA1:	B16C0D19797C7A0CC665BC8346ECF453234A83A4
SHA-256:	2736C2919966D17F27A34D69A7253CD4C2D09C6F7CF9FC03597F27BC73C0BDC2
SHA-512:	C25FC46CA2D8DAAD868FA2B5F1BA6CCAAC7F919C8C7CBB86952741B493D27E79EC8C7FD5F124A704B78F4197E6F3812D0FE0F64BC00117EE2AC09B41FAE85308
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d....4.\.........." .................~....................................................`..........................................G..l...\H..........(.......<.......@...............................................p............................................text...-........................... ..`.rdata..Z...........................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102208
Entropy (8bit):	6.071111727952987
Encrypted:	false
SSDEEP:	1536:8Fqz3IwGZjZ8lt0nt0NhuGO7o6LJ/TJhjYEOYULzEnr:MwYrZNQCnKhnOtthUEOYULzEr
MD5:	CC0E2455CFF19B3585C9FA781428E88E
SHA1:	93EC9326F0CEE4E7F385525B03DDF0DF89A409E8
SHA-256:	AF24B7E339CC6B80ECF7B45050533E8227D6491EED2FD8C3FF2BF22406B027AA
SHA-512:	B995CD999B36B9BD3DC8BE60A7576701CB91D18DF21934521C578047CD135C91F1027058198B1867A4D46804C0514523B370ECEC0E6691A041189011E31166A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...)4.\.........."............................@....................................R.....`..................................................[..........x............p..@...............8............................7..p...............P............................text...=........................... ..`.rdata...g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487232
Entropy (8bit):	6.340203111317007
Encrypted:	false
SSDEEP:	6144:MgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvr:MglSTPaRxFdLXyJ/ebEEkx0rqJduJ
MD5:	AD6C433A57BE03EE0C75076D6FE99CD5
SHA1:	219EE785F2C8127DAA44B298B5B2B096FCCE8D12
SHA-256:	8A180D92A2C879A3384D24A38EC8C9FD6BFD183935E61DA0B97F1C67A7EC9EA7
SHA-512:	041FB9165068D0EA879632B883B3E247336A3BB159ED46AE053B60D074A0BB231FA2DEEDD6CB2BA17AACB771413A86A3F970480AF7A2311E51702288D3B9A30E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t.....................................b....@..........................................4..........x....p.......@...(...P..@............!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892224
Entropy (8bit):	6.044434154548935
Encrypted:	false
SSDEEP:	12288:qpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so2:kZ5F/bYogxJUB9cwtHFMDp
MD5:	BB98224B0CB6F17D61AA24D7A46A08C5
SHA1:	DB78D1161EAA0C691DF76D1B6D7CC98793007BCE
SHA-256:	23A30F94360D710BB020DF76E7846AB991EDD6CA3C7F685AECF6CD1A019D451A
SHA-512:	D74291E8556911B77588D63EB20DB5D6642C31FEDD9EE186AE62D53C705F0CDBE14725ECBB8FC5FE770F45DFF05731EEBB2063A33BB78DF70B73CDCF4E86C465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................O.....@........................................../..{.... .................../...~..@...........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.630939020655746
Encrypted:	false
SSDEEP:	12288:+kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLd:SzBEGbL4Np84TQazCSiRd
MD5:	A0D2853BE8043F5FC4FEE04CFE5A8293
SHA1:	4FDF21E578739ABB4BCC938568F27897E733E229
SHA-256:	1D8C77B674F8294DB39B2CDE2873BDE5A2F6EBD65E14CAEEB58FBA94C92C1F3D
SHA-512:	FC5CE23DF55EF277D6DB898D5620697A3A061A5DD9BE63145CE71B966905CAC41B9785121709A2A0DCF8F90B76F484FAB619EB8DB40A873A867468ECF1620F99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0...............@............................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33600
Entropy (8bit):	6.281064018328684
Encrypted:	false
SSDEEP:	384:az2vV5RqtDcvnyQW7I+Ud26uiGKjzAVQjXzPishb8pe+7mNwSumexmMK6jcy:hgo7WcDGuB3Upe2m9uZxBKg3
MD5:	BED53AB8B9E406D1A8D6A85924E44282
SHA1:	19628BD3DE2BEF0EDC3622E4A7184162BD979040
SHA-256:	E5A10A74CFC36A4DCFCC9B25573B92A37B55062153EF9120B93154DB5792B3DA
SHA-512:	6F5C6945B0A982E8C94A826685158286D16173F51B10FDF1F5B9F4F93562240736A09B5F0997E995C0AF07360BACD51FA46CB8E4A3FA319519F3727FF87613E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...,4.\...........!.....F...........D.......`......................................a.....@.........................pU..W....M.......p...............d..@...........................................(...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159552
Entropy (8bit):	6.178643199247813
Encrypted:	false
SSDEEP:	3072:VYM7lLXShoSAJzKb9P+K61JJBsJgTcqTIbMNZ3mo+aGh1G:77tK+K61vBsJKcq0bMNZPXP
MD5:	F0A9D47D76E68883F04E60599EADAE6D
SHA1:	8F7BB6B9E9CB70529FA4C442ABF507A2F546E6E3
SHA-256:	2FAB0969C6E131834496428779A0809B97981F3E8D6FBF8A59632CB2DF783687
SHA-512:	18BBD1A3899C6B2F361BFA575D50D7DA29EAEF0E1C7CB50B318CECFE3150F268C1CDF30FEB5246B9F9B5D7FE36BD4A268E06595D9D3F3D86D933F14F5C43AD43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....3.\...........!.....L...N.......0.......`......................................k.....@.........................P...l...............(............P..@.......< ...................................z..@............`...............................text....J.......L.................. ..`.rdata...B...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..< ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87360
Entropy (8bit):	6.424955012685773
Encrypted:	false
SSDEEP:	1536:df1NQOOvFdve0e0ZIMhn9nA2LYK7ZOgkg6znnLnx9Inz1:/Adve07RnlhRN6znDQx
MD5:	66C5F108A058B515BBDDE628384990C9
SHA1:	0FBADFC5106056DFD269DF5EA532F69556CAE68F
SHA-256:	8D596D33CC3962B33B46D361BBC44A8088F18C09949734F3DEC54828372426AE
SHA-512:	6060EF07244385516989DF3AAD1C01E9F93B7B45A247D8D70FC5BE7A62BA96BFD22F80F0C78D178443D38796A2C7148CD3ADF4EB1A5FC430DFF5BB393492901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...$4.\.....................n....................@..........................p.......C....@.................................d........@..x............6..@....P..........8...........................P...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383296
Entropy (8bit):	6.650287803080611
Encrypted:	false
SSDEEP:	6144:yplBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lATI:O0/djgEUhWnJ2UlxqOttoICvPn/318Sm
MD5:	C3F39388BD4E6763F9734BC617388A17
SHA1:	AF5B4753F99C3F115294662876D7191DC8652786
SHA-256:	4D1F6A595889165B6A14B68D848C639748C9750C165BB4515CA3C3C67B4BA462
SHA-512:	BD8D00461E65F156686B0FC799926897845900F072F7AC10B66387E041CC7D3810ADBFB0137E9EA7B24995A11D324707D9E0FCD699D36E62ED089F46CC5ABA58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................Z!....@....................................x.......................@...............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	755520
Entropy (8bit):	6.198681499104638
Encrypted:	false
SSDEEP:	12288:IlIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxn:IvM36KkyCLW7QCwSGon
MD5:	0822EE0FF996BEB2B31EBBDD6449231B
SHA1:	7DF7F4978F3C4728CAEF9F95C6EB6C0D8CF8FDAC
SHA-256:	D727150FA7853748655E9CAA9F19F633E33BD191284703D6609984A64CB39CAB
SHA-512:	A47D25901FAD0507167E241350EC12C8D545F3F932E1B44E5F167A82263BCB97DA06B09454E8DE815EFC445088F2B1011028C3EAE5BF3F55FACAA3D9EC082815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p.....................................@.............................{....3.......p...............h..@....`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.629918098777896
Encrypted:	false
SSDEEP:	12288:tkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:LGBEGbL4Np84TQazCSiRC
MD5:	385152D096A96D1966C1042EDE38114F
SHA1:	A42D0587A2BF156C3F757778397A2E7AC8122E3C
SHA-256:	5A22FE5AF587540A9840E4F2A515564A2478DDA47AC1C81B687AC2F59C4C2FD0
SHA-512:	483E8819C6C5C1BCF725A4D6513364A5EE054E1D9100A8F42FFD2DBBFD52910CCA8E6DAF4435103C75AA2EBCA5A608BCC76EE6C531EA67C723267D9445D40256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@............................................................@............................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52312
Entropy (8bit):	6.450469916547452
Encrypted:	false
SSDEEP:	768:MsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYBZyIh9rOQ:Mza/pu/TKJ/OMpTryYzyMCQ
MD5:	4E84DF6558C385BC781CDDEA34C9FBA3
SHA1:	6D63D87C19C11BDBFA484A5835FFFFD7647296C8
SHA-256:	0526073F28A3B5999528BFA0E680D668922499124F783F02C52A3B25C367EF6D
SHA-512:	C35DA0744568BFFFEFF09E6590D059E91E5D380C5FEB3A0FBC5B19477CECA007A882884A7033345CE408FCE1DEAC5248AD9B046656478D734FE494B787F8A9F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...r.;`.....................$...................@..........................`....................................... ..q............P..................X....@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9223040
Entropy (8bit):	6.355581719432468
Encrypted:	false
SSDEEP:	196608:vL7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wbl3bc2EeJUO9WLcb0K:9lOJDm1Wrc2EeJUO9WLcbN
MD5:	8A9BDA9B9A84BD1551A09B65DFBC0C74
SHA1:	14FB48758D664917D789C21DCCB26D9D987F099F
SHA-256:	1D0F8C96F77C339A5F01822B9375131B0B0A49D6CAC45589CDB4B749DAA79773
SHA-512:	BBFB78B3652532E97F66E2DE7BFBEEFCB59254D9E626C62FF1B2E735AF2549B5483AB07739F6C9A686304C5042CDA79312028293959500BAC2A1EFE91B7732DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..f..i.t......!...*.~G...e..0............G...(m..........................j..........@... ......................Pc......`c.0"....c.............x..../....c............................`.S.....................\|ec..............................text....}G......~G.................`..`.data...,o....G..p....G.............@....rdata........H..0....G.............@..@/4...........0U......$U.............@..@.bss......... c..........................edata.......Pc.......c.............@..@.idata..0"...`c..$....c.............@....CRT....0.....c......8c.............@....tls..........c......:c.............@....rsrc.........c......<c.............@..@.reloc.......c......@c.............@..B/14..........`f.......e.............@..B/29..........pf.......e.............@..B/41......b...0h..d....g.............@..B/55...........h.......g.............@..B/67..........`i.......h.

C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7137640
Entropy (8bit):	6.481515443983134
Encrypted:	false
SSDEEP:	98304:ZRE7yGktThDyt6666666666666666666666666666666x666666666666666fww8:XGktThD0TGh/fTCRwlRvZG3XYBVX1
MD5:	0DF9039CE4896584A206A40F48A07C6A
SHA1:	34F0F9AEFD5E37B6B02D062B8AB967DC0F3D2F21
SHA-256:	1DDE27F0410E59561EAB79A6C8EF6DF2ACEC52E92C9AC646135CD91940F2BE05
SHA-512:	FCF74DD6BF3491D2E56A963ABF028EDA8DF17C11ABB793E6E3DAAD3C1E6C1AEE2F731B23CE243872B588CDF7B1B6382804F6B5204DFFC04F266BE3A329945FA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..f..T.i......!....(E..Q..:...........@E...0g..........................U.....7.m...@... ......................`P......pP.......P.............`.l../....P..#...........................FH......................rP.L............................text...`.E.......E.................`..`.rodata.@....0E......$E............. ..`.data...,(...@E..*....E.............@....rdata.......pE......XE.............@..@/4......L.....I.......H.............@..@.bss....X9... P..........................edata.......`P.......O.............@..@.idata.......pP.......O.............@....CRT....0.....P.......P.............@....tls..........P.......P.............@....rsrc.........P.......P.............@..@.reloc...#....P..$....P.............@..B/14...........Q......:Q.............@..B/29...........Q......BQ.............@..B/41......Y....S..Z....R.............@..B/55...........S......(S.

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11132168
Entropy (8bit):	6.740943395722077
Encrypted:	false
SSDEEP:	196608:kngOxqtJKXthIbi0EFrJIj35fGsX1bdXtK:kgOxqtQOUJ85jFhXQ
MD5:	CB9BE257064162076EBD4869CD97E166
SHA1:	49A8CACD48036784A413D63A242ED178BD75CBE9
SHA-256:	8A3822D52B4D460430B9E8E0FA6E6BD2C458598E4DBC2529DF7F2BDF902D2DD2
SHA-512:	013B7E7CCC77531C0D6FA81083B2F16CD0A2B2124105B2F855A478F1F114D3DBA75259B82596645E6BABD91E129E7F7F60AA85ECA32BD95F454B1A8A63B52EFB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................H...b#.....DW.......`....@.................................!....@......@..............................RX...@..\|................/.......v......................................................t........w...................text............................. ..`.itext...X.......Z................. ..`.data...\....`.......L..............@....bss....................................idata..RX.......Z.................@....didata..w.......x...4..............@....edata..............................@..@.tls....h................................rdata..]...........................@..@.reloc...v.......v..................@..B.rsrc...\|....@.......&..............@..@....................................@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21764872
Entropy (8bit):	6.6100525724973656
Encrypted:	false
SSDEEP:	393216:KEpVg+4nw7m2R8VLgZDMwyA7FWBdlY74ZV:tZR8VLg8AGYs
MD5:	D563A4D6BFCFE6884D1AC88824CB5C2A
SHA1:	710C0369915390737ED9BC19252F517D2D2939ED
SHA-256:	DE0FA71C1CFF03D657CB65A86072E964060C628AA4EB709CBE914DD772EF298D
SHA-512:	219D6307697CB12FA56020E6B2DC8FF5D13904FD318E2ED3646B294FAA1A613D838D0350E59B911023EA6F6D62CE53E402F975CAD4311D9A7DA58BD675AE2DB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................4....R.....<N.......P....@..........................`X.......L...@......@...............................b....!.8X7...........K../...0..`............................ ...............................p..:....................text............................... ..`.itext..`........................... ..`.data........P.......8..............@....bss.....................................idata...b.......d..................@....didata.:....p.......8..............@....edata..............................@..@.tls....h................................rdata..].... ......................@..@.reloc..`....0......................@..B.rsrc...8X7...!..Z7.................@..@..............G.......:.............@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388696
Entropy (8bit):	6.639766301981685
Encrypted:	false
SSDEEP:	6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
MD5:	E247666CDEA63DA5A95AEBC135908207
SHA1:	4642F6C3973C41B7D1C9A73111A26C2D7AC9C392
SHA-256:	B419ED0374E3789B4F83D4AF601F796D958E366562A0AAEA5D2F81E82ABDCF33
SHA-512:	06DA11E694D5229783CFB058DCD04D855A1D0758BEEAA97BCD886702A1502D0BF542E7890AA8F2E401BE36CCF70376B5C091A5D328BB1ABE738BC0798AB98A54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................A...............................@q.......q..........................X........(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640536
Entropy (8bit):	6.686577023894573
Encrypted:	false
SSDEEP:	49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
MD5:	D5C2A6AC30E76B7C9B55ADF1FE5C1E4A
SHA1:	3D841EB48D1A32B511611D4B9E6EED71E2C373EE
SHA-256:	11C7004851E6E6624158990DC8ABE3AA517BCAB708364D469589AD0CA3DBA428
SHA-512:	3C1C7FB535E779AC6C0D5AEF2D4E9239F1C27136468738A0BD8587F91B99365A38808BE31380BE98FD74063D266654A6AC2C2E88861A3FE314A95F1296699E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*..............................................5.......................................(............7..............X..............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265816
Entropy (8bit):	6.521007214956242
Encrypted:	false
SSDEEP:	3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
MD5:	49C51ACE274D7DB13CAA533880869A4A
SHA1:	B539ED2F1A15E2D4E5C933611D736E0C317B8313
SHA-256:	1D6407D7C7FFD2642EA7F97C86100514E8E44F58FF522475CB42BCC43A1B172B
SHA-512:	13440009E2F63078DCE466BF2FE54C60FEB6CEDEED6E9E6FC592189C50B0780543C936786B7051311089F39E9E3CCB67F705C54781C4CAE6D3A8007998BEFBF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0..............................................4...x.......................X......../..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373336
Entropy (8bit):	6.7704943019914845
Encrypted:	false
SSDEEP:	6144:faoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtOd:noPH0GgEp0gVd1ValsQXsHOd
MD5:	EDA07083AF5B6608CB5B7C305D787842
SHA1:	D1703C23522D285A3CCDAF7BA2EB837D40608867
SHA-256:	C4683EB09D65D692CA347C0C21F72B086BD2FAF733B13234F3A6B28444457D7D
SHA-512:	BE5879621D544C4E2C4B0A5DB3D93720623E89E841B2982C7F6C99BA58D30167E0DD591A12048ED045F19EC45877AA2EF631B301B903517EFFA17579C4B7C401
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b.....................................................@..........................M......@N..d.......0...............X.......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	880216
Entropy (8bit):	5.239371133407635
Encrypted:	false
SSDEEP:	12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN9S:YYF+Eyx2lzujtEIYRc1cQmsGa7ON9S
MD5:	642DC7E57F0C962B9DB4C8FB346BC5A7
SHA1:	ACEE24383B846F7D12521228D69135E5704546F6
SHA-256:	63B4B5DB4A96A8ABEC82B64034F482B433CD4168C960307AC5CC66D2FBF67EDE
SHA-512:	FB163A0CE4E3AD0B0A337F5617A7BF59070DF05CC433B6463384E8687AF3EDC197E447609A0D86FE25BA3EE2717FD470F2620A8FC3A2998A7C3B3A40530D0BAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................:W....@.........................`...........d....P..p............R..X....`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307297220466426
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugb:gJjJGtpTq2yv1AuNZRY3diu8iBVqF9
MD5:	01924786672282EC8E0CB99C2BBF7E8D
SHA1:	C84F144739E6E567D8B3E20B32C379CA37943EE0
SHA-256:	30ACAF870AF99529371921FB1E68E5A481EAC74F9AD6F4D399F07C2710A71FAA
SHA-512:	8FC9B1A933E43617E619C9E21810701166752AFF3C5D380D747DE687004D9E3F3FB6B2213BF33C297BA8BF8B0FC7FCED95597AA6948EABC372FFA0D540C3E590
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x16300ed9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585576682536013
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	56CCE8DE8D1513634C88E9C4E9FBF0E9
SHA1:	ADAA1C2E1FA92AB18164409A6AA22F9A18B40D93
SHA-256:	3A7D02962D437E321B5CCF3A49EDE71167A8DC043490B00A46D114B4F9831DF2
SHA-512:	E5F29827D67A567DC2A02D88B791C3470AE4405F66AAA098F81A8FBF8A68E6108D9BF68EC7C2ED87FE263C02E8DF081964C8F0D0C7B6878F3CFA76E13B3882A4
Malicious:	false
Preview:	.0..... ...............X\...;...{......................0.z..........{.../...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................>3K./...\|7.................v..8./...\|7..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08069385573086038
Encrypted:	false
SSDEEP:	3:LdFGlKYeY4JkGuAJkhvekl1t5eZOallrekGltll/SPj:pFyKzFqrxlQ3Je3l
MD5:	02F9A650023907AED32D71467A0F8440
SHA1:	A9C16101A7B0B408B77D84EC1F2334B63FD8EFE3
SHA-256:	C8A8E1ED1D282DC59927B2DA4D9BB98B080808734FC91DE8DB4FF6D0D3B0863B
SHA-512:	3854CF7878A14C7EBA879869C55E27869C4B97A0C04E23D1FFEE09F6D85934123281D0A591DD37A7B6C15B932D8A3D5EAF236B0ECC421111D12EA00862FB60A0
Malicious:	false
Preview:	.#.......................................;...{.../...\|7......{...............{.......{...XL......{..................v..8./...\|7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Remote Manipulator System\Logs\rms_log_2024-12.html

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	6338
Entropy (8bit):	5.408268556578575
Encrypted:	false
SSDEEP:	96:lr0xccoJxML6RLidRLi1ongO6gozqf7IdfcMug:lzcWS6pidpiogOSjd
MD5:	6549D9644FCAF9B7D28F7F6D96672D97
SHA1:	759DD771893C4515AB9A792BB79CB48BD7E97FCA
SHA-256:	F42045846A7C5D04B4536EACEF0086D2245E914F7529C6A2C221A70FCDCDAEC0
SHA-512:	A9860A46E04AFAEBA7BC45678F68D97DCCD00AE67CAB90FA047C84E04F878D8DB604FCBC1D525FD1F68CE8DFD595CBB18C0760B6FBB2CB2FA00895DCAA09D211
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>RMS – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = parent_node.chil

C:\ProgramData\Remote Manipulator System\install.log

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	4.983690686317267
Encrypted:	false
SSDEEP:	6:oe4LmKRL/9e4Ldd/ao9e4LhHujHO7eVVe4LwmnXjKV9e4LOLGeXkRLNWy:oNfjNDSo9N9Be/NRTiN6r06y
MD5:	A5B88A312EDD4DDEFBD09D952268EC15
SHA1:	70CF1D773C14D140CE03ABF8B72528C8FD731AE5
SHA-256:	4D637C43C0ADCD25DCA4BD35299934717705F81632B6712F3CFB305BEB321183
SHA-512:	CCDFBC8E67945AD644A50F31A08276FDC72E7BA75A5240810721FE98FD6991CF45FEABA703E546682DC037BCCD33099C6AB6BE05DFB5998BC5021230F82B2DFE
Malicious:	false
Preview:	03-12-2024_02:47:26#T:SilentInstall: installation 70270..03-12-2024_02:47:26#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..03-12-2024_02:47:26#T:SilentInstall: OpenService: service not found_1. OK..03-12-2024_02:47:26#T:SilentInstall: CreateService. OK..03-12-2024_02:47:26#T:SilentInstall: finished (installation) 70270..

C:\ProgramData\Remote Manipulator System\msi\70270_{77817ADF-D5EC-49C6-B987-6169BBD5345B}\Word.msi

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.1571060838923253
Encrypted:	false
SSDEEP:	3:kkFkllcVIXfllXlE/0htlX16pFRltB+SliQlP8F+RlTRe86A+iRlERMta9b3+ALU:kK3JN+SkQlPlEGYRMY9z+s3Ql2DUevat
MD5:	C5057D970B09AFA329CD5AD953904203
SHA1:	C518FD66FEBC0114C812AD7C4B4BB0BE1BF4FDF6
SHA-256:	5AD9851D9D0BF221A0E21CACFD92DFE8FDC0E3C85B2C3724BE8DC6643D98AB9D
SHA-512:	5CE31079A9752B39DB97F12605CA2EBE0D505154FB8D038E679AEDD7750598E5A4CF56207F0020FA8805AB9007E01A0D62D0CCBB3B1C0BDBD810CF0D040F5384
Malicious:	false
Preview:	p...... ........00y.WE..(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8429436188665402
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxVxl9Il8u4C9gmy36dtDeUxACfqjOyd1rc:vxYuC99y3+eUxAfjm
MD5:	AFA452E357DE719F148264F8CD958EFF
SHA1:	07D6687C1CF2C14216FA03F9CB4F38B54DBC9C86
SHA-256:	8D130E04282C38E2A9EABBADE6BA458BFD48739E5F46A4EB1F29AA6CC4F9B77B
SHA-512:	68B621C781CE74FC37C495AD304CB5600572B274A78AEB70C8FA08B0258D277F329F0A07206EB10819046F7E95B6350EDED2D08C0B800AFA6B4BBC66E812392B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.U.U.8.1.9.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.C.F.w.3.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8936831492217556
Encrypted:	false
SSDEEP:	48:uiTrlKxJxdxl9Il8u4Cu/cLC77jjMWqdOFrQ6cZyCHDPd/vc:YYuCu/cS7vMWGOFrQ6cZy8K
MD5:	F38936591BFF9097E7E56AD1E5A0A58F
SHA1:	6AB17CC9AD997C42A033EFF8E994B4B05B06BA34
SHA-256:	377A77A0F9C75821F239E27FB563AFAA89815B9958B0C1DB2A4E7515CF3C5D3B
SHA-512:	AF91F377117F183B2A16B7D4F9CFC028A6D9C71A36795E142F5E38C36C83C6351D62204C469631F870BA238F87D571CC039F1D5D40CA297D991A1CA1DFF38A85
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.f.Q.8.C.i.l.k.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.C.F.w.3.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.003038763501965
Encrypted:	false
SSDEEP:	96:uYuC0K0ipQ3uGqWBDDPs25Q2bdSbi30fmgT4Sc2uljwD:uTVYG9Bn/5Qjbi3DSlulcD
MD5:	64EC4B9F5F0652D82290A3DB820D6070
SHA1:	9871BE45A7DF570B3FF77118FE74F691A4D91C04
SHA-256:	F6B223BEA21E8C6CABA181B660E5F8BBF5F7117447455BCB52004EDDCF212FC6
SHA-512:	FB2D12A7E01C3BD8749846C7B7D86D16A7197C83FD87B21F2F4596D472CD06D417B8B743E407530D310BD6706329D560D0034025B0AE25190B6551B5C64CC13E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.o.O.j.2.F.d.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.C.F.w.3.f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4ED312F.jpeg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1428x2020, components 3
Category:	dropped
Size (bytes):	217242
Entropy (8bit):	7.641248072397463
Encrypted:	false
SSDEEP:	3072:0yKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGq:0yKKhEKBSf/vv8vyNjz9oltkyY2
MD5:	6CFFBB054A1BD06B3B1018684467A551
SHA1:	347CECCBDFCE4CB2AA96F90735C2F5975E9ABC3F
SHA-256:	E0967AD8F4F2DF25AD1343AABF1C144E48D83BC3E61E2122F5BBF9A83EA63709
SHA-512:	24726671FEFA5228737C2E3E2CC159ECA90CD770022051A07C4C059B5378DA251E70568C956CB00631E12424FF5218E7A9A9BE30B0F4D47C277FC470218F88F0
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:(......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{7B889923-D78F-40C3-A108-8A6AE3A8A421}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.09783851312991518
Encrypted:	false
SSDEEP:	3:llmn/lLfn:YZn
MD5:	881EE5BD27A267B0F01FD15E90AC4309
SHA1:	39D217D0F4BDE69A9A163E9F6C5728FDE81907F7
SHA-256:	90305EA213DDD5187AC57A744160391E8F9CD88FE8C355170291294739AAE912
SHA-512:	870D03A7DE2D66778F5199708387802196419BCA134EF50F6279715EC0EEFCB01AAE209ABCB790397A855301409EC6403A3B002214CB5B07153AD4CBD7B556B7
Malicious:	false
Preview:	../.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733212029237202200_313E7E02-CB81-4FBD-96DB-A5A7AF808A97.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.014298055565663022
Encrypted:	false
SSDEEP:	768:ovTb6iFXm1Sc73cjqEnzTBOOLAphruGPDW+oB:ovTb6iFWsc73cjqEnzTB/LAn5PDW+oB
MD5:	0E826CB7F72CECC82F0E90129533D8EA
SHA1:	1074D1A9BCEC783ED5548936C35E952359ADD0CF
SHA-256:	63601E008BCA60A48794A0F5C57DB251D9CBB76E9A50004F67A9F12596E96209
SHA-512:	F09CEC332000E9F9C80C323BD098AD3C0115A5827ACAF011B53D54F755C5986DC2181BB4F18E79BDCC583E1155B9EAE819890117DEE05E0DE6ED39BFBAEEBF7B
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/03/2024 07:47:09.481.WINWORD (0x1694).0x12BC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-12-03T07:47:09.481Z","Contract":"Office.System.Activity","Activity.CV":"An4+MYHLvU+W26Wnr4CKlw.7.1","Activity.Duration":249,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...12/03/2024 07:47:09.497.WINWORD (0x1694).0x12BC.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-12-03T07:47:09.497Z","Contract":"Office.System.Activity","Activity.CV":"An4+MYHLvU+W26Wnr4CKlw.7","Activity.Duration":2475,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureD

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733212029237750300_313E7E02-CB81-4FBD-96DB-A5A7AF808A97.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCD7B4E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B4E.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD7B4F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B4F.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD7B75.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B75.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD7B76.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B76.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD7B86.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B86.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD7B87.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B87.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD7BD3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7BD3.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD7BD4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7BD4.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD7BE4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7BE4.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7BF6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7BF6.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD7BF7.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD7BF7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C08.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7C08.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7C09.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7C09.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD7C0A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C0A.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD7C1A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C1A.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD7C1B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7C1B.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7C35.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD7C35.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C94.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C94.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD7C95.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C95.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD7C96.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C96.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD7C97.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7C97.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD7C98.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C98.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD7CA8.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7CA8.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD7CB9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7CB9.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD7CBA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7CBA.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD7CBB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7CBB.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD7CDC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7CDC.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7CDD.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7CDD.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7CDE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7CDE.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD7D0F.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD7D0F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7D3F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7D3F.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD7D5F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7D5F.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD7DCF.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD7DCF.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7E6E.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7E6E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7EAD.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD7EAD.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7EE0.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7EE0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7F00.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7F00.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7F11.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7F11.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7F61.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7F61.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD81E6.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD81E6.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD81F6.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD81F6.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8217.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8217.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8248.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD8248.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8305.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD8305.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8460.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD8460.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8480.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8480.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD84EF.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD84EF.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD882E.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD882E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8987.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCD8987.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8EE9.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD8EE9.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8F0A.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD8F0A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD90C1.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD90C1.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD9259.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD9259.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\cab7B2C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab7B2D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab7B2E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cab7B60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab7B61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab7B62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab7B63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab7B64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cab7BA8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab7BA9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab7BAA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab7BBA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab7BBB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab7BBC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab7BBD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab7BBE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cab7BBF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab7BC0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cab7BC1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab7BC2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab7BE5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cab7C1C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab7C1D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab7C1E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab7C1F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab7C20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab7C21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab7C32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab7C33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab7C34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab7CBC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab7D0E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab7D9F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab7E0E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab7E2E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab7EAE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab7EBF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab7EC0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab7F12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab8118.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab8167.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab8168.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab8218.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab82C6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab83C2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab8440.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab84B0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab87CF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cab8929.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cab8D9F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab8DA0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab9024.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab91DB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	modified
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:uVX:uV
MD5:	0B194F86E83D9652C8CF8D9E240F8EB3
SHA1:	1D1EB2BF4EC88AAD421ECB0188A3AB693DD2785D
SHA-256:	40D59731D707E1887A3A7F9C3CB4F3683C4ACACEB55322A09A60D4A940011452
SHA-512:	953062CC787AEEA76A702B3D18736E96C89BE90C9D9C7097AF7D09B54A939701A72EFB5F89DD7CDF55191C4CFA8D7BFE7B3855FD212478B2CCF4CDF936D5EA2A
Malicious:	false
Preview:	.....-........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Doc.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Dec 3 06:47:04 2024, mtime=Tue Dec 3 06:47:11 2024, atime=Mon Dec 2 20:13:15 2024, length=230038, window=hide
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.589993550930095
Encrypted:	false
SSDEEP:	6:4xtQl3HgD8fatl0kl//LiIeugDO/Rej+cccljAlxx23LXlIRo3wrlHmyayvGmZp1:8ig1l0sXLEeqcUjAULXluGya5mV
MD5:	7B643633DB8128B81CAC8B6CBFDE8B26
SHA1:	CD64DFC6E636947940A881348EFAD2DBF00195D8
SHA-256:	5107F60B02DF1F310C86205124B4B4A94E3E2C7F11559262F86A8946CAD3B63E
SHA-512:	37A5E798813A706C6E3044A8738FDB5B45F58AFEAB4E545C563128D19A843A91D8E94C1B2601C051A3DCE5909F63D088B61A8A1D511FEB85A1E3CE50A784B9E4
Malicious:	false
Preview:	L..................F.... ....4.WE......WE......D...............................P.O. .:i.....+00.../C:\...................P.1......Y.=..intel.<......Y.=.Y.=....x.....................s..i.n.t.e.l.....Z.2......Y.. .DOC~1.DOC.B......Y.=.Y.=....y.....................,dE.D.o.c...d.o.c.x.......@...............-.......?............F.......C:\intel\Doc.docx..#.....\.....\.....\.....\.....\.....\.....\.i.n.t.e.l.\.D.o.c...d.o.c.x.`.......X.......301389...........hT..CrF.f4... .d.2=.b...,...W..hT..CrF.f4... .d.2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.247557492317427
Encrypted:	false
SSDEEP:	3:HqdLBCm4UcBCv:HA9hGs
MD5:	CE7BCCD008058E0D96C85995FABBDC9F
SHA1:	939A8927196DC4C5E90B32234C1484B72052F5A1
SHA-256:	2AD83E8B46EF787ABC53DC07C6D648975AF14441067BCC46017DA2B1A3DEE6CC
SHA-512:	6D2B32C16C0B0E330EDC39C20F0666CC128F5A16D82E34837D7951FE71E02B8A5BA20CD3F0ECAA58D570B110FFCCA113FC87D4CA5C4ACBE3B557B21F20CAB872
Malicious:	false
Preview:	[misc]..Doc.LNK=0..[folders]..Doc.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QETlbol9:QEiv
MD5:	5FFBAD261CA1D087BDEA2DAA185561A0
SHA1:	A961E6EBC140F64BC9CBD47EB820DF77764969AB
SHA-256:	2FFE94EBE8D67CD72EE7F1D088DA8AC1B6BA2EBAB80463CC38AC10617ADF933B
SHA-512:	DE56BFA3EF7EB40E7D40CCEC2A99795CEEEB708F7D2E47520A6F82AAC3A72D69F4887BF3C515FB0C0136AF6D04DC90E4CBF4A704E13561EC3171373ABAE1D73A
Malicious:	false
Preview:	..a.l.f.o.n.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CMDBSEPTW11E9QHQSPI0.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KYRDXLUC6ZHOKF8EH9JB.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF352d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\Installer\4c8461.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\4c8464.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI8991.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8ADA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1447471
Entropy (8bit):	4.935928888043589
Encrypted:	false
SSDEEP:	24576:hMMMMMMSLLLLLLLFMMMMMMSLLLLLLLsMMMMMMSLLLLLLLi:hMMMMMMSLLLLLLLFMMMMMMSLLLLLLLsb
MD5:	09935D887C3ED53FE077D215888F0D19
SHA1:	B8EAB2909A151D238F93ABBF36A5B7D61AB25FF7
SHA-256:	26BE89B58552BBA1DCD8F62BE9F51235DB7C9EEB6A800C7152AE1CB62EECF446
SHA-512:	D3814A83E95B08FE0EEC943485FDF55636B7636F0E9B4847ED89478C430708E3DBB5BD7805FF446A36AA0A1EB0875118B8E3B83535DEF396F49DF58F496E1B7F
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.]....@.......@........ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2....@.....@.....@.]....&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}8.C:\Program Files (x86)\Remote Manipulator System - Host\.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}...@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}D.C:\Program Files (x86)\Remote Manip

C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.161253569716644
Encrypted:	false
SSDEEP:	12:JSbX72FjujSAGiLIlHVRpzh/7777777777777777777777777vDHF5t07x6uPp0V:JU+QI53vt016uy8F
MD5:	8C0174358EA65B3E4EE8881325092A31
SHA1:	69DE93C278AAE4D183114795843D5910AD883AC6
SHA-256:	EE9B3A58AFF1A8B74DE9EE2709079C52DA9D65C1BF0DE7ABB7769CC23F298553
SHA-512:	07755EC11B920B6F6388A6F1E79C814B24D4CB5004DB9CBC50DB3D9842F58B122F3FF5DD69B3B60E679F6D1322C820A4FC5423DF94C1B6DAD175EE7C3E5DA9C1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9258080898398173
Encrypted:	false
SSDEEP:	48:K8PhXuRc06WXOcnT5LaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOdgL:VhX1anT9aUGkOzs9t4ZqvGkOzs9rf
MD5:	7FE5E190B00FF0D16BAF4B5BC0B3AA0B
SHA1:	20F813238B67A8E738433BB43D6FC867624B9956
SHA-256:	BB8CF9E783E0EBB0A7FFFDA43F7082EB4B0DBED41D3B0509A59FF5D3EE561FAA
SHA-512:	46B8057381E0790CED7CEB283FD9D42666537FC95992AAE3DF18B985A2F383762FE92C6B99EC093DA4A1CF6586244C778DDA59A186A548137678266426881A9F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79000
Entropy (8bit):	5.817675016279098
Encrypted:	false
SSDEEP:	768:/MAyYdTmPJbgqcnDckJ42T1IPAMxkEo2T1OtoAMxkEbK:/1U81ckJ52xVPxnK
MD5:	E8CBBBE641AA6205C0E028CE7DC72CFE
SHA1:	E845FB6044E5F611F4F990B76AA4762FAB6E96C9
SHA-256:	61481606FE3FF53C9483586B4A95181D96F5679667ACCD582166069B10233D77
SHA-512:	D12E6BBA83F1B41BB2B937B315C5CDD3ADFA60C318AD1E958D99251822810739D2C6EC75B664BBC3116B0CDBBBFA4BEBA234B8C604F303391E21CDA0C24767E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(.......t0...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	5.60723121147002
Encrypted:	false
SSDEEP:	768:RdMAyYdTmPJbgqcnDc/soJP2T1qAMxkEvQ2T1h8uAMxkE4:/1U81cLJOGxF/hxM
MD5:	F0F36966AD2B91DBE0C8B9D4E0A1AB0E
SHA1:	B7787445DDD42A3B4753AFC0B02B270DDC1693FC
SHA-256:	BE3C9594F315F2CE2698DFF54F7B41F012B25BF208DD88CEA7AC92936EC84AE9
SHA-512:	B178A35B3F0A3CA67D632901C1F0AF309F51267DFA827AE029475C63BCF2BA51694C717C94989D7E457E915DAE74B43C3C6B405113249A7B1FF0E9BAE67E0949
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.........................................................................4T..(.......\................d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.6899574334599645
Encrypted:	false
SSDEEP:	1536:c1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL+:UjcT6uuuutMMMMMMSLLLLLLLeYTZg
MD5:	6A9AA00C428A946F9A5C5546A458ECA0
SHA1:	06A70B197DEE2FC106576C6719CFF046D2747396
SHA-256:	16601981E37F2FE16B8E0EA4626ABF57013458B63D1A71C8FA3B5080F3C191F5
SHA-512:	EADDEE089D18ED744BB1DCAAA98A8F6E201022432C55D037D2A7EF994532197EF595E44DEEF9DB0CFAE8ACA50F4AB90CEEDB49F8E920E6B4FAF6C60B6EFEDD51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................v.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690218208041496
Encrypted:	false
SSDEEP:	1536:R1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLe:DjcT6uuuutMMMMMMSLLLLLLLeYuGVk
MD5:	AB85C5EEAD096C4E5D0A2914C24F59B2
SHA1:	E189F9BA583B0A4EEE1C817C9DA8A5D72A038A83
SHA-256:	F4F656CC3CD99ABC4CFC1A70BD77C52E36D59852987BE530E131CEF8238F4BA7
SHA-512:	E70ACF9FCA9F0378FAC97421550984FF166D8D1D83F423400B108E804CA876EA6D7517398637D64C34CC0E46C14048BB9F50C8268D993FA983DB6B0E44A9C352
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................>.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690232052098797
Encrypted:	false
SSDEEP:	1536:o1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLU:IjcT6uuuutMMMMMMSLLLLLLLeYFuv
MD5:	03A18CE97AA1C45D834524B8A408BC17
SHA1:	72ABD8B4AC974928684B6D089F8573C70D431808
SHA-256:	0ACFCA29B6128E0161B4E6D93FFF7686A96128016846625763DAB7F9CE059DEF
SHA-512:	2A2DC903E4179EC83BB4FA557FFCCE8BA3D8FC175E9C817D34BA186704ECF06A281D96D35B12B8D54FE35683030942FDC9A3A1FDFDBEAA755A60436F3C7B3483
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@........................................................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364483
Entropy (8bit):	5.365491356474972
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauT:zTtbmkExhMJCIpEe
MD5:	0308999A811AB9D10BFBF7AB9879D693
SHA1:	F74A26C715CEA0AB96EE9C7ECFA0E3D8457431B8
SHA-256:	9D5D5B31B0F4D9ADC5D3E374BBF403A5BA90B949411017F486FD09D16333AF9B
SHA-512:	3139EB00463CB6F42BF80A2D7FB20388240E65C8972946120F9745E773E8FFEFF9EA1FFB463587998AB55E7370220BF681A9ECF8B364B2154E2863F1AD97AD51
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	6544
Entropy (8bit):	6.429559611327131
Encrypted:	false
SSDEEP:	192:Ez88fedNBkYmpEiaDE5XFO06rYCqRXUBQv/dJIy7/:XvdMEiaDE5XMrhQv/dJIy7
MD5:	A3796AB67F070EA6658EFF00B2E28C93
SHA1:	CDD319F9CD83861632E0976CB57A8753C93F9229
SHA-256:	E388C3C7067FBF804A2DFA07D33F0192814282E7FC75609F8D57D9ECA39B1F74
SHA-512:	1C3A70C12BE77D16EFDF1B386B73ECA98A7CA87671980B7D898D3CBBA3631AEA907224B722F4B4B3400A12221C662BA29BB0B51A0C40E9B7FD3FE60A490345CC
Malicious:	false
Preview:	0...0..t...0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 2020..241203055448Z..241210055447Z0...0...$....oZ&....240813120056Z0...z..t{..\|...210126064802Z0...b.....$......210222211006Z0...KOY7A.HI.._e..210222211004Z0...r..'wi..]..n..210222211002Z0....&......e...210222212203Z0...s..........S..210222212205Z0...<.r8>.,......240904080004Z0....!.Z.j.....o..240906101526Z0...&e.....U.....240916183602Z0...2p'.]A..AL..210225044747Z0+...>.".K.y..<...210226150613Z0.0...U.......0...6..C..M.1...210308171016Z0...5.L<ea..X\|.e..210326070003Z0......%...R~..v..210528124802Z0...wP...:^....M..210709151203Z0...i#c~c...x0W...210406072402Z0...H.....?..a...210428153602Z0+..s...O...a.I..210503115753Z0.0...U.......0...Y.Y....^.^...210524083602Z0+....iW..(v..9...210604033751Z0.0...U.......0...~.T..!...h.}..210604164111Z0......q..k.0.u...210615133333Z0...\C...."{......210621174758Z0..._Kx.B.........210622165609Z0.....U...$......210712152133Z0

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.591719202977513
Encrypted:	false
SSDEEP:	24:Vk1I3jh1pD2HwgnJD8Xm3BP4whFPSGBAS7jF78oekZdCrphruWeI8h6FfymkBZGN:d1xGnt8W3BvDj9BdCusxIsfLamo3T6
MD5:	C6AB6B4A31AD48F68089E6B7B8922082
SHA1:	28C257DAD9B1DFEF52B28090E118FE538F6D0811
SHA-256:	F0A9F73221A0ACF764C9971520BF9B6CF9A9968499445227132303A248B9E0B0
SHA-512:	C16D17546E37D9FACAFE8B504D476FB028F1029F805612FF04AF82A8803FD7EC636904E7120D54CE8C5666719460341BBD5768DF628A1D08507616D505763CE0
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........j......t........20241203054027Z0s0q0I0...+..............B..M.%..Dg..5 .....F...x9...C.VP..;..w.......T..r...G....20241203054027Z....20241207054026Z0....H.............)..n....Q.K.w.N.g.......A[2\|.+. ^..-]...<S.Vr.C....p&o..x;.fq....q....yh.f.zygY2..P@.W.t..K.N$..\..Wq..sod...(f.~g.t..s&.j.8.Q....3.4...!.r..{...z....W./4.7\|...ay.. ......Jc../'l_..5.+5...w3.^....0.X.I....$z.+.\.=..Y./.....a.....<..j...+../5.G.~.>.....0...0...0............\|.w.7@$.L.!...0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...240717031756Z..250215000000Z0g1.0...U....BE1.0...U....GlobalSign nv-sa1=0;..U...4GlobalSign Code Signing Root R45 - OCSP 1.2 202411070.."0...*.H.............0............U...;..pc+..o.K..0...6.'...F.C..}.....%E..F.q.-\.u{..$.....#8.,{...^OEQ..P..~ZU..f.0........Ky+..(..q.............sy...e.0...Z.]X1.A....z.....g.p.{.~,u.0R..f.SOx".Q_.{......`T.&[&2..P\|.......h.Z(A;.3.]$...k`.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.609103808405835
Encrypted:	false
SSDEEP:	48:+sR2QSKyg2G237nIxCw5DgSUnpU446J8WpNTE:F9Z2N37n4Cw5MSiw6mOTE
MD5:	9B7CEE7FC2507E7B498924A5DD1F64B7
SHA1:	703360D20DC050704F9E518722F1EB59E07D237F
SHA-256:	406E6229A2C02CEA8A1314AB7D8437BBFA0341CE545E196B28F9A2990252ABBD
SHA-512:	9C20F9FFE6EF56534678A3FB7CC3882602FF772BA893279437D32026AAACC83F8F7EA442C9D438593DA21AFAFF640903ECA604BEE302C5CB2A7ED7841D504CB0
Malicious:	false
Preview:	0..........0.....+.....0.....r0..n0............`...H,.&...=...20241203052001Z0o0m0E0...+...........r...nK..._..[.Q.....$..kw...Y.!gdv.x..vF...M...k3....20241203052001Z....20241207052000Z0....H................ih..]."...h.vc..]f.......M=\|..Z./.......`.....I...:.AP&.%.rn..6"..Z...7UD,...D.N.W.!..K..B.B;.!.....j...Z....\......C.L>..N...-.y.xM....%...)...p...?o.,.....@U..Q...G......... ...u.pQZ...y<$Q..9....-.y.Rr.%....V..}...!N.?..s.z.X..>D/...F...l....0...0...0..........f3...z.....0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 20200...240920234113Z..241221234112Z0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'gsgccr45codesignca2020CA OCSP Responder0.."0....H.............0.........+..6b.I...$...f.C.K?}.s...r;.y.m,]q.....@.N.2..x.F5Y........%.).....>.yH.....*.\.9.<..ns..,..jQ.....~..V.N..Y.........8.a..Rg..A3....[.p<......by..Y.y...9....7%.%.i$..I..T~........2i....R..rW..~.!..e...;....\.9;<L.._..I.Fe.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.512406297170673
Encrypted:	false
SSDEEP:	24:qFVjIZwF1jqmvfagpNORwfF7YpQfvmE1yPq8hruWa2tHP+HLuuDXXWLaH:iSuF1jqgfvORK9q3nPq4uRY4LuubXv
MD5:	FB64D17430ADF5FA8629690D4BD179EF
SHA1:	5432DE65FA17D02D7B62683E48E306471D22D943
SHA-256:	28980FB3D5245F81736F6233894B6D3C0CD17062FCA4B51192C138605E9E9CB9
SHA-512:	B7D9D9372461B71B9EC5AA11034CD6D88CD850D6F86256FA756494DF8896F2768938E4C21A7620E053A46BC08A7B1E55F2782B2FBD2EAA1E78569F3A3E0FDE98
Malicious:	false
Preview:	0..........0.....+.....0.....}0..y0......$L..\|6..h(4.]........20241203044354Z0s0q0I0...+..........h.$..y.u.3.V..G.....K...E$.MP.c.........x..BEp.A.o...T....20241203044354Z....20241207044353Z0....H...............J.WF.0.Q8...B.}i..'.UT...{....._._.....kG.Z.......\|...H#.fH......5.},...75^,....b.EQ......1..t...=k....!L.U.gX....4W..F...........,.<.$.N....]...\.BM.N.4`.............\|..\4L.s.G=.)...>.s..f.'.Sk...{xK)."\|7.oy...wY.6..}T..:H6...{._).$......0...0...0............\|.X........-..0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...240717031720Z..250215000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign Root R3 - OCSP 1.2 202411070.."0....H.............0..........U\m..$.o@E.<.c..).S..L...HN.<W\|.F .........h...zo..vk..%M.".j.P..U!/..v.Th.R..(.i..$P....^l..@qe....q.l..6....cB.:.;.KU......J..>.....$..(.h J.6;.....N..(r).i....o.<-..c..2.]<.7r.../.Ni..}q...8B.LT./'...=b.>....C........"..

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A62E94087F64223B9812F11186592BA

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	222
Entropy (8bit):	2.888868625432543
Encrypted:	false
SSDEEP:	3:kkFklv7dgRXfllXlE/hRbltlOyR8rHelJlWlLltUKlrlxUXW4mgelSlj:kK5cJXl7pWhliKxlxUDmgrj
MD5:	66E561731C67DE0A0A87F44DE5462C79
SHA1:	FF088098A4E7AA3F409D798AACA6D1198E31DA68
SHA-256:	E62BBD82C84FF2F31A04D80B5BBE9F0825837BF142E04079FF04C608B42ECE1A
SHA-512:	EDBCC0958283E56F78F6523D89F044AFCF5EEA868F3088416E204D657FFEC84EF0B1F1F36CFCC02B88EFA86FAF1ED1D951222FF5AE692D6F6688F0E642144D7F
Malicious:	false
Preview:	p...... ....j..... .XE..(....................................................... .........b.GE.............b........h.t.t.p.:././.c.r.l...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0...c.r.l...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	532
Entropy (8bit):	3.947178126546914
Encrypted:	false
SSDEEP:	12:RYdqtz/DWzJqe3KQj22iv8sFF1gUeMalCrlQNlVgfM1Iweql6aU/:eotz/DgJRjYvP+U7uCKlCM1IwRU/
MD5:	5BEE55B27504D6B14682440C6420B674
SHA1:	C2A57F6EE4A067D4C1BBAC29839AC871EB6DE49E
SHA-256:	919B729D4BA1F8B41174FF3BF457262AA8AC1D570710F80F67D3E086F207A2B0
SHA-512:	14884B701DF54A5F021ABC4BA2D2DF7CC30AC90EB3C0C06CCF9F040FC0A86D63CBE72411AF5DF74B15348BAA235DC6534D19F057197BB69B5ED867CC6A2E7E45
Malicious:	false
Preview:	p...... ....J...?.p.XE..(................W0.EE....>.jH....................>.jH.. ........W0.EE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.Q.V.F.Z.P.5.v.q.h.C.r.t.R.N.5.S.W.f.4.0.R.n.6.N.M.1.I.A.Q.U.H.w.C.%.2.F.R.o.A.K.%.2.F.H.g.5.t.6.W.0.Q.9.l.W.U.L.v.O.l.j.s.C.E.H.e.9.D.g.O.h.t.w.j.4.V.K.s.G.c.h.D.Z.B.E.c.%.3.D...".2.8.c.2.5.7.d.a.d.9.b.1.d.f.e.f.5.2.b.2.8.0.9.0.e.1.1.8.f.e.5.3.8.f.6.d.0.8.1.1."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	3.827870344229167
Encrypted:	false
SSDEEP:	12:jxAOtpCW8gzfDWzf79bLgLzK8sFAY6ealztksMGH4Z+h:FTp3zfDgz9YLmvqY6mIh
MD5:	81358269074426BD0F96689D006CC06A
SHA1:	F7237E2153A1D8CEF00AE4708A67E673AB92EE5F
SHA-256:	CD1CAF69629C1FFC4A17B93E725470F81A39EEFC84B11D15645444A0B4CE0961
SHA-512:	FA9F40F452713E89220BE9459452F3165C47F6412D5A22884EB9C081173B102670065E50DAD37A04A99D6C3B84483FCB012902CF58DA0652EA92D4534DE965E5
Malicious:	false
Preview:	p...... ....V...6C..XE..(.................o.CE....~.gH....................~.gH.. .........o.CE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0./.M.E.0.w.S.z.B.J.M.E.c.w.R.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.L.u.A.3.y.g.n.K.W.%.2.F.7.x.u.S.x.%.2.F.0.9.F.%.2.B.h.H.V.u.E.U.Q.Q.U.2.r.O.N.w.C.S.Q.o.2.t.3.0.w.y.g.W.d.0.h.Z.2.R.2.C.3.g.C.D.H.Z.G.D.p.D.i.h.E.2.3.%.2.B.Y.N.r.M.w.%.3.D.%.3.D...".7.0.3.3.6.0.d.2.0.d.c.0.5.0.7.0.4.f.9.e.5.1.8.7.2.2.f.1.e.b.5.9.e.0.7.d.2.3.7.f."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	3.9808194266229227
Encrypted:	false
SSDEEP:	12:3KOaPCkzVDWzFU8iv8sFt4QAfROA/pULoAQlmlEXJ:SPCkzVDgFUhv/ofROS6LofcluJ
MD5:	A5DECDA9B1C3E6B1D19C81ED63624023
SHA1:	3FCBB01B5C168AD798C0BC8520A885CFE1AD6BFC
SHA-256:	22FEEA3B3BAEB0CE5444DE8D255BB16582229CAC78368FDDA3BAE5E7954C6912
SHA-512:	61AA04385AEDC644C0A3D8DAFE85C982BC473F90B9C0BC48C56089E512FFD23CC69611241635DE1A5E611C7AC43EB15124B1F570DD89CC2F0DC1ED749CF62A65
Malicious:	false
Preview:	p...... ....2....JsXE..(...................=E.....bH.....................bH.. ...........=E......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.r.o.o.t.r.3./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.1.n.G.h.%.2.F.J.B.j.W.K.n.k.P.d.Z.I.z.B.1.b.q.h.e.l.H.B.w.Q.U.j.%.2.F.B.L.f.6.g.u.R.S.S.u.T.V.D.6.Y.5.q.L.3.u.L.d.G.7.w.C.E.H.g.D.G.E.J.F.c.I.p.B.z.2.8.B.u.O.6.0.q.V.Q.%.3.D...".5.4.3.2.d.e.6.5.f.a.1.7.d.0.2.d.7.b.6.2.6.8.3.e.4.8.e.3.0.6.4.7.1.d.2.2.d.9.4.3."...

C:\Windows\Temp\~DF1824809D33FF74D6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06843743119485104
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOZft07x6qkWrkoVky6l0t/:2F0i8n0itFzDHF5t07x6uC01
MD5:	B23A8F32998499DA774A3479193D91FB
SHA1:	0FE95AAD29FA238A9488C7C9BF7E1E265A18497B
SHA-256:	3272D0750CE59B4FF12F23F507659A50D8EC4C4562130BD41A529780E660C33D
SHA-512:	DBF24A27950DB9528F76E5FCD10F74518083DBBEBB583EA4CDD4295B3122B16640F7AA9C5E3D27DF38E2B0B40E89FF575FA3BBAF249FC0DBB25A4CAA9F7FB30E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF233B17258DCCB5E2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF411F62FE6F19CCE4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5418320E456EEBB7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5177994720608723
Encrypted:	false
SSDEEP:	48:hwPuUNvcFXOzT5XUkyqaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOd2:qPMuTZtxaUGkOzs9t4ZqvGkOzs9rf
MD5:	A7B5C8536EE27AD82589394EE5C17E25
SHA1:	6A81D8C0355AABBA18F89274B86395D3E16DDE90
SHA-256:	089E81FD957B5421B404F156EA7CF2E0EF281BDBB673304109A725FBA419D7DA
SHA-512:	F86048CCDB3C934B7DEA8A5FA5E1B593D7DBBCF2695BCBD267848B982784C5B65D336039425FD3A36887B3A86556C798437A5969562212B74B28BB16D53A95BB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5B69EE6DA6F4EE26.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF60201421137453CA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5177994720608723
Encrypted:	false
SSDEEP:	48:hwPuUNvcFXOzT5XUkyqaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOd2:qPMuTZtxaUGkOzs9t4ZqvGkOzs9rf
MD5:	A7B5C8536EE27AD82589394EE5C17E25
SHA1:	6A81D8C0355AABBA18F89274B86395D3E16DDE90
SHA-256:	089E81FD957B5421B404F156EA7CF2E0EF281BDBB673304109A725FBA419D7DA
SHA-512:	F86048CCDB3C934B7DEA8A5FA5E1B593D7DBBCF2695BCBD267848B982784C5B65D336039425FD3A36887B3A86556C798437A5969562212B74B28BB16D53A95BB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6EA9CD4020C812D9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.2763605650885168
Encrypted:	false
SSDEEP:	48:2IO8XSBwdgfdguOdghRXdgkdgpdgKdg4SKdgfdguOdghRXdgkdgpdgKdgt6Adg8W:HOyqvGkOzs94UGkOzs9t4H
MD5:	1DE9B4955BB8E58482C0E31947122055
SHA1:	0382C8969874A929D22EC117E15BC395EBD4C86D
SHA-256:	CBF7317E945282778AB4F12D26B4AFB7CBF380BFE761D810FB661F7D540104DD
SHA-512:	C88CA4AD19F9BFC96814AD8EF0B3E6DED2C61113EBBA7C3BCD975E70A8C5AAF78818A81F247D19C2F6FFE05DEE8D85C6EF25416E1559332F18D7597687A031C3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF80306864950BFED2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9258080898398173
Encrypted:	false
SSDEEP:	48:K8PhXuRc06WXOcnT5LaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOdgL:VhX1anT9aUGkOzs9t4ZqvGkOzs9rf
MD5:	7FE5E190B00FF0D16BAF4B5BC0B3AA0B
SHA1:	20F813238B67A8E738433BB43D6FC867624B9956
SHA-256:	BB8CF9E783E0EBB0A7FFFDA43F7082EB4B0DBED41D3B0509A59FF5D3EE561FAA
SHA-512:	46B8057381E0790CED7CEB283FD9D42666537FC95992AAE3DF18B985A2F383762FE92C6B99EC093DA4A1CF6586244C778DDA59A186A548137678266426881A9F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8EC37834380B27B3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5177994720608723
Encrypted:	false
SSDEEP:	48:hwPuUNvcFXOzT5XUkyqaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOd2:qPMuTZtxaUGkOzs9t4ZqvGkOzs9rf
MD5:	A7B5C8536EE27AD82589394EE5C17E25
SHA1:	6A81D8C0355AABBA18F89274B86395D3E16DDE90
SHA-256:	089E81FD957B5421B404F156EA7CF2E0EF281BDBB673304109A725FBA419D7DA
SHA-512:	F86048CCDB3C934B7DEA8A5FA5E1B593D7DBBCF2695BCBD267848B982784C5B65D336039425FD3A36887B3A86556C798437A5969562212B74B28BB16D53A95BB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA8B1924BBC12C010.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB3316AFA2177D592.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE3A813CDEEC74590.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9258080898398173
Encrypted:	false
SSDEEP:	48:K8PhXuRc06WXOcnT5LaSKdgfdguOdghRXdgkdgpdgKdgt6Adg82SBwdgfdguOdgL:VhX1anT9aUGkOzs9t4ZqvGkOzs9rf
MD5:	7FE5E190B00FF0D16BAF4B5BC0B3AA0B
SHA1:	20F813238B67A8E738433BB43D6FC867624B9956
SHA-256:	BB8CF9E783E0EBB0A7FFFDA43F7082EB4B0DBED41D3B0509A59FF5D3EE561FAA
SHA-512:	46B8057381E0790CED7CEB283FD9D42666537FC95992AAE3DF18B985A2F383762FE92C6B99EC093DA4A1CF6586244C778DDA59A186A548137678266426881A9F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\intel\Doc.docx

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	230038
Entropy (8bit):	7.636957641054668
Encrypted:	false
SSDEEP:	3072:nzyKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGVVu:nzyKKhEKBSf/vv8vyNjz9oltkyYzcZ
MD5:	773D2787D661474A840B907C8A22D4E9
SHA1:	A6A0E3C4AB4063BC74C65D6EC0CB43B67F1D767F
SHA-256:	BA82FE356B21118D92B04A74EF8466A59F4802FD9B061F6E9A28E16CF7A5A8B3
SHA-512:	7EC868F9B7B47A757BBB5ABF5639F97C47D79AC55DD07954F3EEE93384B555F7C4C817B687C8C486DC97F4174A8CC04DEED342E8ADD6EA2EDB5EE381FC612BEA
Malicious:	false
Preview:	PK..........!..A..f...T.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E........tQUUH.},.HM?...../....;@..(..I6H0s.=.xF..V..\|...d..H..[!M....[.H....LY.9.B ....h.u..T...E......Y.....z."...:..X..~0x...&... ....l.b.......$.Mc....+..@.j<.p.a.).Y.:].q@..2T.=a!].........}...R@2e>.3.]tm....Fev....-...Wn.[.!.w.*k+.I.....q. \.....Qp...s/...W..c..R`...\....xj.....mNEb..[.p.....?..:...(O.um"Z.=.T.@.8.M.8........PK..........!.........N......._rels/.rels ...(...........................

C:\intel\Word.msi

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\intel\~$Doc.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.674331005300397
Encrypted:	false
SSDEEP:	3:t4qKF0n4ejBl4XRre0HmzFG+u+MlEM4n:JK+4ejBlYRreAmM+u+KEHn
MD5:	CB062ED57A6ED1FA07DC763E259B4CC7
SHA1:	AC0B7D3E0868C34C2DE4457266044594E6F98339
SHA-256:	96A78DD90CAB162D8A1EE5B7DE88220DC15F2886DCBC550F978E2D3513306F4C
SHA-512:	5DF6F437961E3CAB96299EF9D65E4778D9F47EE66D966F5BA94AC2471637FE207D7E92ADF58189036F0BB96CA55B91055446D0E9859DBEA04DC0729D141ABD39
Malicious:	false
Preview:	..........................................................m......6..o......Y]lW..R.KIY..R.+k.m.Yv2.}...Ou{=.W.^m.7E}'...C..EWE.......+h.....}.j.....V...=_j

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998140922332344
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	442.docx.exe
File size:	25'141'051 bytes
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
SHA512:	fcaba4304f26eefa476202e17ca85c3f994d2086f78fa86f1d73f7d6c926825a4ac3b02ceae2d8cde3583f02fdbf87139741035368f6d4b77c4f8c790df330fd
SSDEEP:	393216:bnD8YsCFVxnq/mIhNAl2543UCCCQrTTNi5NRmclImNm/U29ieL:bgYlFV8/1AbOrXNihH29LL
TLSH:	14473325EE400AB1E2FAD47098159413D63C3C5DC228B2A722F997287FF7B755B67388
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0b03084c4e4e0383

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3F10C3C208h
dec eax
add esp, 28h
jmp 00007F3F10C3BB9Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F3F10C3B023h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F3F10C3BD33h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F3F10C3DD47h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F3F10C2A5B3h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F3F10C3CE02h
int3
jmp 00007F3F10C42FE4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1558c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1558c	0x15600	50f0a4d841d0856138dbb9d7187108bf	False	0.1905953033625731	data	5.443581422941128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x7109c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72648	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 15118 x 15118 px/m	0.06374955637051934
RT_DIALOG	0x82e70	0x2ba	data	0.5286532951289399
RT_DIALOG	0x8312c	0x13a	data	0.6560509554140127
RT_DIALOG	0x83268	0xf2	data	0.71900826446281
RT_DIALOG	0x8335c	0x14a	data	0.6
RT_DIALOG	0x834a8	0x314	data	0.47588832487309646
RT_DIALOG	0x837bc	0x24a	data	0.6279863481228669
RT_STRING	0x83a08	0x1fc	data	0.421259842519685
RT_STRING	0x83c04	0x246	data	0.41924398625429554
RT_STRING	0x83e4c	0x1a6	data	0.514218009478673
RT_STRING	0x83ff4	0xdc	data	0.65
RT_STRING	0x840d0	0x470	data	0.3873239436619718
RT_STRING	0x84540	0x164	data	0.5056179775280899
RT_STRING	0x846a4	0x110	data	0.5772058823529411
RT_STRING	0x847b4	0x158	data	0.4563953488372093
RT_STRING	0x8490c	0xe8	data	0.5948275862068966
RT_STRING	0x849f4	0x1c6	data	0.5242290748898678
RT_STRING	0x84bbc	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x84e24	0x14	data	1.15
RT_MANIFEST	0x84e38	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T08:47:38.233328+0100	2849354	ETPRO MALWARE Remote Admin Backdoor Related Activity	1	192.168.2.5	49803	111.90.147.125	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 08:47:36.515091896 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.517756939 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.517992020 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.519622087 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.521377087 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.522263050 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.635766029 CET	5651	49802	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.635898113 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.638658047 CET	465	49804	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.638741016 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.638895035 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.638992071 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.639883995 CET	5651	49805	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:36.639945030 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.641918898 CET	55555	49806	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.641977072 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.642234087 CET	8080	49807	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:36.642281055 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.668026924 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668051958 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668170929 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668195963 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668247938 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668265104 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668303013 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.668330908 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.668368101 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668390036 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:36.668436050 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.668456078 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:36.787998915 CET	5651	49802	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788022041 CET	5651	49802	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788204908 CET	465	49804	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788255930 CET	465	49804	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788268089 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788276911 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788527012 CET	5651	49805	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:36.788532972 CET	5651	49805	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:36.788543940 CET	55555	49806	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788552999 CET	55555	49806	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:36.788562059 CET	8080	49807	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:36.788573980 CET	8080	49807	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:38.232934952 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.233238935 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:38.233262062 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:38.233272076 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:38.233292103 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:38.233328104 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:38.353204966 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.353216887 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.353240967 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.353250980 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.353259087 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.788727999 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:38.948190928 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.233191967 CET	5651	49802	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.233304024 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.233470917 CET	49802	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.282239914 CET	55555	49806	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.282362938 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.283157110 CET	49806	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.324259043 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.326065063 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.354825974 CET	5651	49802	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.405154943 CET	55555	49806	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.444730997 CET	5651	49817	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.444855928 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.446285009 CET	55555	49818	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.446357012 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.449898005 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.451394081 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.451394081 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.451414108 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:39.569791079 CET	5651	49817	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.571728945 CET	55555	49818	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.571758986 CET	55555	49818	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.571772099 CET	5651	49817	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.789566040 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:39.948117971 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:40.805579901 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:40.948143005 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:41.821355104 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:41.865641117 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.030281067 CET	5651	49817	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.030344009 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.046101093 CET	49817	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.046838999 CET	55555	49818	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.046910048 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.081856966 CET	49818	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.166512966 CET	5651	49817	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.180402040 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.181130886 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:42.183617115 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.201788902 CET	55555	49818	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.287136078 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.297142982 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.300451994 CET	5651	49824	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.300523996 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.300976038 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:42.301071882 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:42.303560972 CET	55555	49825	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.303642988 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.306375027 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.306399107 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.306437969 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.306463957 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.306725979 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:42.306773901 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:42.407357931 CET	5651	49829	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.407457113 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.413752079 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.413768053 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.417149067 CET	55555	49831	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.417248011 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.417891979 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.417911053 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:42.528366089 CET	5651	49824	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.528383970 CET	5651	49824	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.528392076 CET	55555	49825	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.528399944 CET	55555	49825	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.528409004 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:42.528417110 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:42.528419971 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:42.537960052 CET	5651	49829	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.537969112 CET	5651	49829	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.651356936 CET	55555	49831	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.651371002 CET	55555	49831	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.836167097 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:42.948116064 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:43.852066040 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:43.948124886 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:44.029345036 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:44.260607004 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:44.273865938 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:44.448137999 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:44.629756927 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:44.750016928 CET	5655	49823	95.213.205.83	192.168.2.5
Dec 3, 2024 08:47:44.751693010 CET	49823	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:47:44.867274046 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:44.929361105 CET	55555	49825	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:44.930213928 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:44.931533098 CET	49825	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:44.961267948 CET	5651	49824	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:44.962590933 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:44.962666988 CET	49824	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.038281918 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.040731907 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.047835112 CET	55555	49831	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.048579931 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.048691034 CET	49831	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.051352024 CET	55555	49825	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.057497978 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.070229053 CET	5651	49829	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.070626974 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.070689917 CET	49829	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.082513094 CET	5651	49824	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.158305883 CET	5651	49834	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.158390999 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.160624981 CET	55555	49836	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.160706997 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.163511992 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.163552046 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.163888931 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.163921118 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.164905071 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.166158915 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.168534994 CET	55555	49831	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.169475079 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:47:45.190547943 CET	5651	49829	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.283394098 CET	5651	49834	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.283405066 CET	5651	49834	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.283746004 CET	55555	49836	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.283785105 CET	55555	49836	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.284864902 CET	5651	49840	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.284946918 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.286010981 CET	55555	49841	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.286118984 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.286128044 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.289386034 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:47:45.289453030 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:47:45.290191889 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.290340900 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.290364981 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:45.290703058 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:47:45.290750980 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:47:45.406055927 CET	5651	49840	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.410054922 CET	5651	49840	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.410270929 CET	55555	49841	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.410279989 CET	55555	49841	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.410547972 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:47:45.410793066 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:47:45.410805941 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:47:45.883369923 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:45.948306084 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:46.887161016 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:46.932508945 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.790815115 CET	5651	49834	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.791662931 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.791695118 CET	55555	49836	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.791743040 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.793024063 CET	49834	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.796750069 CET	49836	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.885884047 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.886739969 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.898582935 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.912910938 CET	5651	49834	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.915555954 CET	5651	49840	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.915644884 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.915693998 CET	49840	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.917252064 CET	55555	49836	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.948364019 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.950134039 CET	55555	49841	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:47.950193882 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.950395107 CET	49841	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:47.972033978 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.006716013 CET	5651	49849	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.007380009 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.007721901 CET	55555	49850	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.007796049 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.007968903 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.008045912 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.008397102 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.008419991 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.035542011 CET	5651	49840	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.061454058 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.070477962 CET	55555	49841	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.091890097 CET	5651	49851	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.091972113 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.092672110 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.092706919 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.127820015 CET	5651	49849	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.127957106 CET	5651	49849	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.128362894 CET	55555	49850	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.128377914 CET	55555	49850	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.181349993 CET	55555	49853	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.181420088 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.181678057 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.181693077 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:48.212615967 CET	5651	49851	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.212661982 CET	5651	49851	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.303617954 CET	55555	49853	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.303643942 CET	55555	49853	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.914751053 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:48.963741064 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:49.931818008 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:49.979377985 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.594746113 CET	55555	49850	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.594805956 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.595000982 CET	49850	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.680393934 CET	5651	49849	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.680458069 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.680506945 CET	49849	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.686927080 CET	5651	49851	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.687645912 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.691816092 CET	49851	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.715528965 CET	55555	49850	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.719670057 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.722099066 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.800359011 CET	5651	49849	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.805244923 CET	55555	49853	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.807341099 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.807821035 CET	49853	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.811692953 CET	5651	49851	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.814492941 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.841403008 CET	5651	49858	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.841483116 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.841854095 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.841865063 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.843379021 CET	55555	49859	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.843466997 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.843732119 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.843744993 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.904959917 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.927870035 CET	55555	49853	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.934417963 CET	5651	49860	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.934511900 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.937072039 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.937098026 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:50.945969105 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.962416887 CET	5651	49858	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.962428093 CET	5651	49858	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.963620901 CET	55555	49859	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.963632107 CET	55555	49859	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:50.994985104 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.024909019 CET	55555	49861	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.025006056 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.025347948 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.025373936 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.057126999 CET	5651	49860	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.057140112 CET	5651	49860	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.145447016 CET	55555	49861	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.145458937 CET	55555	49861	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.667651892 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.667676926 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.668073893 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.685215950 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.687216043 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.700406075 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.784041882 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.787509918 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.788220882 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.805166960 CET	5651	49862	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.805243969 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.805520058 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.805532932 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.808247089 CET	465	49863	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.808304071 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.820298910 CET	8080	49864	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.821739912 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.828911066 CET	465	49804	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.828922033 CET	5651	49805	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.829229116 CET	8080	49807	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.831343889 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.831346035 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.831444979 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.831468105 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.903887033 CET	8080	49865	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.903963089 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.904227972 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.904241085 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.909013033 CET	5651	49867	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.909097910 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.909329891 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.909356117 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:51.909827948 CET	465	49868	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.909885883 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.910109043 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.910145044 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:51.925451040 CET	5651	49862	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.925509930 CET	5651	49862	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.951419115 CET	465	49863	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.951427937 CET	465	49863	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:51.951436996 CET	8080	49864	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.951445103 CET	8080	49864	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:51.962352991 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:52.010617018 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:52.025281906 CET	8080	49865	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:52.025371075 CET	8080	49865	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:52.029359102 CET	5651	49867	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:52.029367924 CET	5651	49867	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:52.029980898 CET	465	49868	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:52.030080080 CET	465	49868	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:52.977591038 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.026283026 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.452289104 CET	5651	49858	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.452442884 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.452505112 CET	49858	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.469818115 CET	55555	49859	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.471705914 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.473862886 CET	49859	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.546380043 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.547125101 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.563122034 CET	5651	49860	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.563689947 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.565036058 CET	49860	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.572510958 CET	5651	49858	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.594430923 CET	55555	49859	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.639607906 CET	55555	49861	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.639769077 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.639909029 CET	49861	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.666384935 CET	5651	49873	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.666476965 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.667119026 CET	55555	49874	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.667187929 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.670736074 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.670753002 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.670789957 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.670804977 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.671188116 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.684925079 CET	5651	49860	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.749682903 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.759730101 CET	55555	49861	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.790944099 CET	5651	49873	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.790957928 CET	5651	49873	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.790968895 CET	55555	49874	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.791098118 CET	55555	49874	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.791398048 CET	5651	49875	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.791486979 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.791801929 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.791835070 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.869712114 CET	55555	49876	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.869788885 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.870497942 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.870518923 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:53.911781073 CET	5651	49875	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.911792040 CET	5651	49875	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.990485907 CET	55555	49876	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.990497112 CET	55555	49876	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:53.993079901 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:54.041870117 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:55.008538008 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:55.057511091 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.024710894 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.073128939 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.265940905 CET	5651	49873	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.266000986 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.266072989 CET	49873	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.334439039 CET	55555	49874	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.334527016 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.334562063 CET	49874	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.377346992 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.377907991 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.385973930 CET	5651	49873	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.455468893 CET	55555	49874	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.461242914 CET	5651	49875	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.461319923 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.461369038 CET	49875	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.483047009 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.494242907 CET	55555	49876	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.494304895 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.494493961 CET	49876	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.497899055 CET	5651	49885	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.498097897 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.498255014 CET	55555	49886	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.499965906 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.500260115 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.500272036 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.500308037 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.503634930 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.581274986 CET	5651	49875	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.591943026 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.604171991 CET	5651	49887	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.604245901 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.605108976 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.605149984 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.614363909 CET	55555	49876	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.620178938 CET	5651	49885	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.620196104 CET	5651	49885	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.620204926 CET	55555	49886	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.623517036 CET	55555	49886	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.711891890 CET	55555	49888	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.711978912 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.712192059 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.712205887 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:56.725052118 CET	5651	49887	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.725070953 CET	5651	49887	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.832034111 CET	55555	49888	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:56.832055092 CET	55555	49888	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:57.025830030 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:57.075954914 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:58.039711952 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:58.088802099 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:58.575052023 CET	5651	49805	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:58.575138092 CET	465	49804	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:58.575135946 CET	49805	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:58.575189114 CET	8080	49807	78.138.9.142	192.168.2.5
Dec 3, 2024 08:47:58.575189114 CET	49804	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:58.575333118 CET	49807	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:47:59.055378914 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.104373932 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.133785963 CET	5651	49885	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.133843899 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.133964062 CET	49885	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.135036945 CET	55555	49886	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.135104895 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.138216972 CET	49886	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.217755079 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.226881027 CET	5651	49887	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.226954937 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.226991892 CET	49887	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.231384993 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.253863096 CET	5651	49885	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.258604050 CET	55555	49886	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.327806950 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.337718964 CET	5651	49895	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.337802887 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.338025093 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.338032961 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.346966982 CET	5651	49887	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.351361990 CET	55555	49896	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.351435900 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.351618052 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.351628065 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.385698080 CET	55555	49888	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.385756016 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.385859966 CET	49888	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.442145109 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.447789907 CET	5651	49897	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.447935104 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.451189041 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.451338053 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.457911015 CET	5651	49895	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.457968950 CET	5651	49895	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.471498966 CET	55555	49896	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.471539021 CET	55555	49896	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.506278992 CET	55555	49888	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.561989069 CET	55555	49898	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.562069893 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.562834024 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.562913895 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:47:59.571021080 CET	5651	49897	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.571198940 CET	5651	49897	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.682661057 CET	55555	49898	111.90.147.125	192.168.2.5
Dec 3, 2024 08:47:59.682727098 CET	55555	49898	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:00.070312023 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:00.120074987 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:01.085998058 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:01.135649920 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:01.963143110 CET	5651	49895	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:01.963223934 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:01.963334084 CET	49895	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:01.977197886 CET	55555	49896	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:01.977271080 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:01.977314949 CET	49896	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.062416077 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.063271999 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.083369017 CET	5651	49895	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.085796118 CET	5651	49897	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.085896969 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.085953951 CET	49897	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.097270966 CET	55555	49896	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.102448940 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.151309013 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.171464920 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.182451963 CET	5651	49902	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.182574034 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.183060884 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.183072090 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.183201075 CET	55555	49903	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.183259010 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.183479071 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.183633089 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.186079025 CET	55555	49898	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.186151028 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.186228991 CET	49898	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.206008911 CET	5651	49897	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.281068087 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.291496992 CET	5651	49904	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.291572094 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.291944981 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.291944981 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.302973032 CET	5651	49902	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.303008080 CET	5651	49902	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.303368092 CET	55555	49903	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.303440094 CET	55555	49903	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.306082010 CET	55555	49898	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.401000023 CET	55555	49905	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.401140928 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.402487040 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.402537107 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:02.412164927 CET	5651	49904	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.412178993 CET	5651	49904	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.522505999 CET	55555	49905	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:02.522521019 CET	55555	49905	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:03.118411064 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:03.166887999 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.134814978 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:04.182528019 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.813494921 CET	55555	49903	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:04.813572884 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.813656092 CET	49903	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.851953030 CET	5651	49902	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:04.852044106 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.852087021 CET	49902	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.905574083 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.906070948 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.933612108 CET	55555	49903	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:04.963234901 CET	5651	49904	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:04.963299990 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.963352919 CET	49904	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:04.973547935 CET	5651	49902	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.014081001 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.025660992 CET	55555	49911	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.025851011 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.025935888 CET	5651	49912	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.025990009 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.026252985 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.026292086 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.026326895 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.026412010 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.047388077 CET	55555	49905	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.047449112 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.047503948 CET	49905	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.083408117 CET	5651	49904	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.125272989 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.134402990 CET	5651	49914	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.134495020 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.134773970 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.134785891 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.146575928 CET	55555	49911	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.146590948 CET	55555	49911	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.146611929 CET	5651	49912	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.146621943 CET	5651	49912	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.148653030 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.167401075 CET	55555	49905	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.198148012 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.245578051 CET	55555	49915	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.245661974 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.246067047 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.246083021 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:05.254684925 CET	5651	49914	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.254697084 CET	5651	49914	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.366064072 CET	55555	49915	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:05.366086006 CET	55555	49915	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:06.165057898 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:06.213783026 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:06.829876900 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:06.882025957 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:06.888134003 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:06.943659067 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:06.949676991 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:06.957108974 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.043699980 CET	5651	49862	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.049006939 CET	8080	49864	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.049031019 CET	465	49863	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.055461884 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.055751085 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.056556940 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.104990959 CET	8080	49865	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.113101959 CET	5651	49867	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.121090889 CET	465	49868	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.175528049 CET	465	49918	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.175623894 CET	5651	49919	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.175724983 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.176431894 CET	8080	49920	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.176465034 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.176496029 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.179781914 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.194305897 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.194330931 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.194359064 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.194366932 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.194406033 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.194443941 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:07.229383945 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.314564943 CET	465	49918	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.314605951 CET	465	49918	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.314615011 CET	5651	49919	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.314623117 CET	5651	49919	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.314690113 CET	8080	49920	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.314722061 CET	8080	49920	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:07.654501915 CET	55555	49911	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.654686928 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.654733896 CET	49911	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.665712118 CET	5651	49912	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.665822029 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.665855885 CET	49912	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.748083115 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.774610996 CET	55555	49911	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.777744055 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.785764933 CET	5651	49912	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.807471037 CET	5651	49914	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.807689905 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.807720900 CET	49914	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.857815027 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.869932890 CET	5651	49921	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.870214939 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.870740891 CET	55555	49915	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.871598005 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.871671915 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.871716022 CET	49915	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.871789932 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.897917986 CET	55555	49922	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.898030996 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.898387909 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.898401976 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.927658081 CET	5651	49914	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.967113972 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.977816105 CET	5651	49923	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.977935076 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.978167057 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.978177071 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:07.991585016 CET	5651	49921	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.991605997 CET	55555	49915	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:07.991657972 CET	5651	49921	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.018446922 CET	55555	49922	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.018464088 CET	55555	49922	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.087213039 CET	55555	49924	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.087282896 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:08.087515116 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:08.087527037 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:08.098076105 CET	5651	49923	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.098084927 CET	5651	49923	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.180495977 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.207506895 CET	55555	49924	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.207518101 CET	55555	49924	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:08.229378939 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:09.196041107 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:09.245028973 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.211884975 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.260653019 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.494167089 CET	5651	49921	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.495212078 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.495434046 CET	49921	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.532778978 CET	55555	49922	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.532849073 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.532887936 CET	49922	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.593214035 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.595487118 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.615266085 CET	5651	49921	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.651604891 CET	5651	49923	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.653331041 CET	55555	49922	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.653434992 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.653599024 CET	49923	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.671603918 CET	55555	49924	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.671694994 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.671823025 CET	49924	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.701400995 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.713243008 CET	55555	49925	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.713304996 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.713524103 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.713546038 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.716212034 CET	5651	49926	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.716301918 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.716502905 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.716528893 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.716639996 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.773431063 CET	5651	49923	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.792320967 CET	55555	49924	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.821387053 CET	5651	49927	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.821460009 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.821649075 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.821799040 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.833493948 CET	55555	49925	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.833554983 CET	55555	49925	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.836431980 CET	5651	49926	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.836448908 CET	5651	49926	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.836522102 CET	55555	49928	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.836606979 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.836780071 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.836790085 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:10.941570997 CET	5651	49927	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.941732883 CET	5651	49927	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.956991911 CET	55555	49928	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:10.957003117 CET	55555	49928	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:11.227197886 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:11.276288986 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:12.243112087 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:12.291892052 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.258666039 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.293746948 CET	55555	49925	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.293872118 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.294891119 CET	49925	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.307512999 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.328491926 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.345138073 CET	5651	49926	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.345237970 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.345324039 CET	49926	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.414895058 CET	55555	49925	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.437465906 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.449327946 CET	55555	49929	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.449377060 CET	5651	49927	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.449440002 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.449480057 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.449575901 CET	49927	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.450150967 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.450172901 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.465286016 CET	5651	49926	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.494038105 CET	55555	49928	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.494854927 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.494908094 CET	49928	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.546189070 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.546288967 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.557487011 CET	5651	49930	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.557569981 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.558119059 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.558146954 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.569411039 CET	5651	49927	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.570076942 CET	55555	49929	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.570091009 CET	55555	49929	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.615909100 CET	55555	49928	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.667720079 CET	55555	49931	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.667732000 CET	5651	49932	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.667790890 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.667809010 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.668912888 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.668932915 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.669567108 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.669580936 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.679582119 CET	5651	49930	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.679744959 CET	5651	49930	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.723287106 CET	8080	49864	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:13.723355055 CET	49864	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:13.738276005 CET	465	49863	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.738348007 CET	49863	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.778732061 CET	5651	49862	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:13.779122114 CET	49862	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:13.789108992 CET	55555	49931	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.789119959 CET	55555	49931	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.789499998 CET	5651	49932	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.789510012 CET	5651	49932	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.856710911 CET	5651	49867	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:13.856856108 CET	49867	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:13.862822056 CET	465	49868	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:13.862943888 CET	49868	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:13.872147083 CET	8080	49865	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:13.872570992 CET	49865	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:14.275768995 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:14.323178053 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:15.239939928 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:48:15.289519072 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:15.291898966 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:48:15.338788033 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.117866993 CET	55555	49929	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.117969036 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.118009090 CET	49929	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.157635927 CET	5651	49930	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.157689095 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.157727957 CET	49930	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.179547071 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.179771900 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.238279104 CET	55555	49929	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.279700041 CET	5651	49930	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.289125919 CET	5651	49932	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.289186001 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.289237976 CET	49932	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.296247005 CET	55555	49931	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.296305895 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.296329975 CET	49931	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299490929 CET	5651	49933	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.299561024 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299614906 CET	55555	49934	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.299704075 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299850941 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299865007 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299877882 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.299880981 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.305198908 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.354398966 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.388539076 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.403681040 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.409274101 CET	5651	49932	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.416270971 CET	55555	49931	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.419934034 CET	5651	49933	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.419945002 CET	55555	49934	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.420010090 CET	55555	49934	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.420018911 CET	5651	49933	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.508548975 CET	5651	49935	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.508620977 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.508821011 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.508876085 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.523627043 CET	55555	49936	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.523730993 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.523916006 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.523916006 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:16.628762007 CET	5651	49935	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.628772020 CET	5651	49935	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.643965006 CET	55555	49936	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:16.643985987 CET	55555	49936	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:17.322941065 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:17.370033979 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.337908983 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:18.385763884 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.891725063 CET	5651	49933	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:18.891783953 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.891835928 CET	49933	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.904697895 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.937308073 CET	55555	49934	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:18.937391996 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:18.937553883 CET	49934	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.012269020 CET	5651	49933	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.013890982 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.024677038 CET	5651	49937	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.024750948 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.024955988 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.024992943 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.057646990 CET	55555	49934	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.133928061 CET	55555	49938	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.134031057 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.134295940 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.134295940 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.145687103 CET	5651	49937	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.145697117 CET	5651	49937	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.150343895 CET	55555	49936	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.150401115 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.150443077 CET	49936	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.182014942 CET	5651	49935	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.182081938 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.182126045 CET	49935	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.232682943 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.248089075 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.254369020 CET	55555	49938	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.254379988 CET	55555	49938	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.270425081 CET	55555	49936	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.302133083 CET	5651	49935	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.352329016 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.352916002 CET	5651	49939	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.353049994 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.353286982 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.353296995 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.368113995 CET	55555	49940	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.368202925 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.368412971 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.368439913 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.401285887 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:19.473186970 CET	5651	49939	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.473205090 CET	5651	49939	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.489155054 CET	55555	49940	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:19.489164114 CET	55555	49940	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:20.367744923 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:20.416928053 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.383069992 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.432537079 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.698596954 CET	5651	49937	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.698677063 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.728751898 CET	49937	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.804075956 CET	55555	49938	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.804169893 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.813653946 CET	49938	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.820696115 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.848750114 CET	5651	49937	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.932290077 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.933670044 CET	55555	49938	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.940638065 CET	5651	49941	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.941323042 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.973792076 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.973803997 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.994502068 CET	55555	49940	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:21.994565964 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:21.998825073 CET	49940	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.024909019 CET	5651	49939	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.026057959 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.046231031 CET	49939	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.052309036 CET	55555	49942	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.052413940 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.086841106 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.086869001 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.094134092 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.094258070 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.095357895 CET	5651	49941	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.095367908 CET	5651	49941	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.118837118 CET	55555	49940	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.166223049 CET	5651	49939	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.203515053 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.206867933 CET	55555	49942	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.206918955 CET	55555	49942	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.210438967 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.214215040 CET	5651	49943	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.214225054 CET	55555	49944	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.217782974 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.221828938 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.230204105 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.242070913 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.242094040 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.242221117 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.242249966 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.308435917 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.313060045 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.313381910 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.362220049 CET	5651	49943	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.362257004 CET	5651	49943	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.362267971 CET	55555	49944	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.362384081 CET	55555	49944	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.369287014 CET	8080	49920	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.373349905 CET	5651	49919	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.393158913 CET	465	49918	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.399240971 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.428442955 CET	8080	49945	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.429781914 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.430068970 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.430068970 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.432993889 CET	465	49946	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.433064938 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.433243036 CET	5651	49947	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.433311939 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.433325052 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.433401108 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.433727026 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.433727026 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:22.448193073 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:22.550021887 CET	8080	49945	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.550071955 CET	8080	49945	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.553214073 CET	465	49946	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.553231955 CET	465	49946	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:22.553725958 CET	5651	49947	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:22.553886890 CET	5651	49947	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:23.427520990 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:23.479454994 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.430423021 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:24.479536057 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.561918020 CET	5651	49941	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:24.565769911 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.565941095 CET	49941	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.639309883 CET	55555	49942	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:24.642108917 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.642196894 CET	49942	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.685884953 CET	5651	49941	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:24.763345003 CET	55555	49942	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:24.937799931 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:24.949147940 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.059056997 CET	5651	49949	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.059175968 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.069139004 CET	55555	49950	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.069210052 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.109136105 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.109148979 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.109292030 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.109313011 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:25.229398012 CET	5651	49949	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.229415894 CET	5651	49949	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.229435921 CET	55555	49950	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.229444981 CET	55555	49950	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.445736885 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:25.495068073 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:26.461997032 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:26.510709047 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.477374077 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.526338100 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.687628984 CET	5651	49949	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.687802076 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.704982996 CET	55555	49950	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.706908941 CET	49949	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.706979990 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.717858076 CET	49950	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.809904099 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.810024023 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.827799082 CET	5651	49949	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.838157892 CET	55555	49950	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.930036068 CET	5651	49951	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.930048943 CET	55555	49952	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:27.930123091 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.930303097 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.930516005 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.930548906 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.930589914 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:27.930692911 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:28.052608967 CET	5651	49951	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:28.053446054 CET	5651	49951	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:28.053494930 CET	55555	49952	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:28.053510904 CET	55555	49952	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:28.492773056 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:28.542005062 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:29.066346884 CET	465	49918	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:29.066385984 CET	8080	49920	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:29.066473961 CET	5651	49919	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:29.066571951 CET	49918	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:29.066595078 CET	49920	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:29.067711115 CET	49919	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:29.508445024 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:29.557547092 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.126440048 CET	5651	49943	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.126508951 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.126548052 CET	49943	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.127634048 CET	55555	49944	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.127686977 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.131575108 CET	49944	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.192745924 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.192895889 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.246483088 CET	5651	49943	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.253098965 CET	55555	49944	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.314886093 CET	5651	49953	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.314897060 CET	55555	49954	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.314970970 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.315732956 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.317850113 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.317861080 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.317924976 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.317924976 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.437791109 CET	5651	49953	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.437803030 CET	5651	49953	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.437957048 CET	55555	49954	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.438033104 CET	55555	49954	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.524738073 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.533684015 CET	5651	49951	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.533761024 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.541577101 CET	49951	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.573163986 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.578548908 CET	55555	49952	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.578605890 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.583539009 CET	49952	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.623601913 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.624639034 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.662318945 CET	5651	49951	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.703444004 CET	55555	49952	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.743554115 CET	5651	49955	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.743624926 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.744569063 CET	55555	49956	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.744628906 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.747797012 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.747807980 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.747838020 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.747852087 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:30.867855072 CET	5651	49955	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.867881060 CET	5651	49955	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.867888927 CET	55555	49956	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:30.867898941 CET	55555	49956	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:31.555288076 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:31.604418039 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:32.571141958 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:32.620090961 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:32.953998089 CET	55555	49954	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:32.954097033 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:32.954179049 CET	49954	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:32.964463949 CET	5651	49953	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:32.964524984 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:32.964569092 CET	49953	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.018065929 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.019768953 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.074593067 CET	55555	49954	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.084496975 CET	5651	49953	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.138133049 CET	5651	49957	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.138217926 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.138523102 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.138531923 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.139686108 CET	55555	49958	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.139750004 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.139884949 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.139897108 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.258419037 CET	5651	49957	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.258639097 CET	5651	49957	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.259865999 CET	55555	49958	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.259876966 CET	55555	49958	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.368427038 CET	5651	49955	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.368489027 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.368542910 CET	49955	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.369693995 CET	55555	49956	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.369749069 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.369796991 CET	49956	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.451603889 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.480979919 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.488786936 CET	5651	49955	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.490257978 CET	55555	49956	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.542998075 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:48:33.572082043 CET	55555	49959	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.572302103 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.572546959 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.572556019 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.586343050 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.601007938 CET	5651	49960	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.601114988 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.601366997 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.601380110 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.635688066 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:33.663362026 CET	5655	49842	109.234.156.179	192.168.2.5
Dec 3, 2024 08:48:33.663415909 CET	49842	5655	192.168.2.5	109.234.156.179
Dec 3, 2024 08:48:33.692468882 CET	55555	49959	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.692478895 CET	55555	49959	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.721287966 CET	5651	49960	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:33.721324921 CET	5651	49960	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:34.602797985 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:34.651335001 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.618567944 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.666970968 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.767087936 CET	5651	49957	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.767159939 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.767200947 CET	49957	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.806668997 CET	55555	49958	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.806726933 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.806768894 CET	49958	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.858380079 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.872288942 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.887303114 CET	5651	49957	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.926747084 CET	55555	49958	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.978708982 CET	5651	49961	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.978794098 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.979011059 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.979032040 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.992232084 CET	55555	49962	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:35.992315054 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.992492914 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:35.992505074 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.099100113 CET	5651	49961	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.099111080 CET	5651	49961	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.112837076 CET	55555	49962	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.112847090 CET	55555	49962	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.203433990 CET	55555	49959	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.203519106 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.203573942 CET	49959	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.230901957 CET	5651	49960	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.230987072 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.231028080 CET	49960	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.295031071 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.324109077 CET	55555	49959	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.325318098 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.350979090 CET	5651	49960	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.414985895 CET	55555	49963	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.415098906 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.415357113 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.415366888 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.445513964 CET	5651	49964	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.447788954 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.448024988 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.448035955 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:36.535253048 CET	55555	49963	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.535317898 CET	55555	49963	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.567992926 CET	5651	49964	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.568005085 CET	5651	49964	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.633208036 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:36.682713985 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.417885065 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.448935986 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.449317932 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.498925924 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.500195980 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.513055086 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.581362009 CET	8080	49945	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.609426975 CET	5651	49947	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.609437943 CET	465	49946	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:37.618885994 CET	465	49965	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:37.619797945 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.620059967 CET	5651	49966	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.620214939 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.620225906 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.620251894 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.620390892 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.620409966 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.632998943 CET	8080	49967	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.633820057 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:37.633943081 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.634080887 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.635744095 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:37.682595968 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:37.740186930 CET	465	49965	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:37.740212917 CET	465	49965	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:37.740268946 CET	5651	49966	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.740291119 CET	5651	49966	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.753992081 CET	8080	49967	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:37.755589008 CET	8080	49967	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:38.578802109 CET	5651	49961	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.578897953 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.578946114 CET	49961	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.592339993 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.627335072 CET	55555	49962	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.627465963 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.627504110 CET	49962	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.649430037 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.698227882 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.698878050 CET	5651	49961	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.701780081 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.712466002 CET	5651	49968	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.712557077 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.712790966 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.714113951 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.747473001 CET	55555	49962	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.821712971 CET	55555	49969	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.821851015 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.822144032 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.822571039 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:38.835184097 CET	5651	49968	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.836074114 CET	5651	49968	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.944449902 CET	55555	49969	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:38.944725990 CET	55555	49969	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.006119013 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:39.086986065 CET	5651	49964	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.087168932 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.087228060 CET	49964	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.087510109 CET	55555	49963	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.087770939 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.087846994 CET	49963	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.126162052 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:39.127886057 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:39.141108990 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:39.141149998 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:39.148274899 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.148334026 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.207179070 CET	5651	49964	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.207720041 CET	55555	49963	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.261132002 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:39.261149883 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:39.261168003 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:39.268357038 CET	5651	49971	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.268368006 CET	55555	49972	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.268512964 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.268512964 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.268907070 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.268943071 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.268945932 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.271753073 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.388907909 CET	5651	49971	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.388925076 CET	5651	49971	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.388932943 CET	55555	49972	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.391644955 CET	55555	49972	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.665373087 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:39.667553902 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:39.713849068 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:39.833806038 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:40.177005053 CET	5655	49970	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:40.179835081 CET	49970	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:40.680140018 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:40.729440928 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.388673067 CET	5651	49968	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.388740063 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.388798952 CET	49968	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.464327097 CET	55555	49969	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.464392900 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.464469910 CET	49969	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.508986950 CET	5651	49968	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.570147038 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.570276976 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.584422112 CET	55555	49969	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.690383911 CET	5651	49973	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.690398932 CET	55555	49974	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.690506935 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.690602064 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.690938950 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.690974951 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.690974951 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.691054106 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.696115971 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.745105028 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.811352015 CET	5651	49973	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.811410904 CET	5651	49973	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.811475992 CET	55555	49974	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.811513901 CET	55555	49974	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.858798981 CET	55555	49972	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.858865976 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.858975887 CET	49972	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.860450983 CET	5651	49971	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.860521078 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.860734940 CET	49971	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.875013113 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.979417086 CET	55555	49972	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.980649948 CET	5651	49971	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.983517885 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.994972944 CET	55555	49975	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:41.995059967 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.996290922 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:41.996303082 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:42.104538918 CET	5651	49976	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.104609966 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:42.105309010 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:42.105330944 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:42.116178036 CET	55555	49975	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.116187096 CET	55555	49975	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.226224899 CET	5651	49976	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.226229906 CET	5651	49976	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.711321115 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:42.760690928 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:43.711575031 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:43.763758898 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.316850901 CET	465	49946	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.316911936 CET	49946	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.321177006 CET	55555	49974	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.321240902 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.321310043 CET	49974	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.353004932 CET	5651	49973	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.353072882 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.353154898 CET	49973	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.372961998 CET	8080	49945	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:44.372982979 CET	5651	49947	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:44.373025894 CET	49945	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:44.373063087 CET	49947	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:44.391767979 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.391890049 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.441281080 CET	55555	49974	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.473206043 CET	5651	49973	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.512007952 CET	55555	49977	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.512022018 CET	5651	49978	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.512089968 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.512125015 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.512639046 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.512665987 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.512681961 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.512795925 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.632672071 CET	55555	49977	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.632695913 CET	5651	49978	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.632714987 CET	55555	49977	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.632723093 CET	5651	49978	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.727452040 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.729146957 CET	5651	49976	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.729199886 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.729238987 CET	49976	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.776314974 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.827814102 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.849236012 CET	5651	49976	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.947846889 CET	5651	49979	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:44.948941946 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.949721098 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:44.949804068 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:45.070627928 CET	5651	49979	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:45.070640087 CET	5651	49979	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:45.105541945 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:45.226057053 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:45.226273060 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:45.227200031 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:45.227224112 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:45.228421926 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:45.347367048 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:45.347415924 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:45.347516060 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:45.389983892 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:45.743325949 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:45.791949987 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:46.308291912 CET	5655	49980	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:46.308370113 CET	49980	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:46.758915901 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:46.885731936 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.148571014 CET	5651	49978	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.148669958 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.148765087 CET	49978	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.184071064 CET	55555	49977	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.185841084 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.185900927 CET	49977	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.233257055 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.234585047 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.268682957 CET	5651	49978	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.305984020 CET	55555	49977	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.353291988 CET	5651	49981	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.354604006 CET	55555	49982	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.354737997 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.355468988 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.355606079 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.355777979 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.355792999 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.355806112 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.475497961 CET	5651	49981	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.475742102 CET	5651	49981	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.475750923 CET	55555	49982	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.475761890 CET	55555	49982	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.581556082 CET	5651	49979	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.581660032 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.581751108 CET	49979	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.670372963 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.701741934 CET	5651	49979	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.774060965 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.790623903 CET	5651	49983	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.790723085 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.791173935 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.791173935 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.885885000 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:47.911192894 CET	5651	49983	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:47.911204100 CET	5651	49983	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:48.789916992 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:48.885718107 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:49.805151939 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:49.885936975 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:49.956584930 CET	55555	49982	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:49.956650019 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:49.956676960 CET	49982	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:49.969785929 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.026700974 CET	5651	49981	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.027817965 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.027863026 CET	49981	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.078697920 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.079075098 CET	55555	49982	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.091408014 CET	55555	49984	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.091495037 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.091804028 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.091804981 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.148216009 CET	5651	49981	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.198853016 CET	5651	49985	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.198956013 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.200460911 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.200469017 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.211708069 CET	55555	49984	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.211725950 CET	55555	49984	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.320413113 CET	5651	49985	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.320425034 CET	5651	49985	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.421179056 CET	5651	49983	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.421232939 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.421345949 CET	49983	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.514884949 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.541578054 CET	5651	49983	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.597071886 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:50.636238098 CET	5651	49986	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.636347055 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.636744022 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.636765003 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:50.718070984 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:50.718156099 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:50.718751907 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:50.718772888 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:50.719532967 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:50.756758928 CET	5651	49986	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.756788015 CET	5651	49986	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.820621014 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:50.838655949 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:50.838665962 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:50.838732004 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:50.885462046 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:50.885694027 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:51.782957077 CET	5655	49987	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:51.783808947 CET	49987	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:51.836523056 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:51.885888100 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.637451887 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.637789965 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.638211966 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.689491987 CET	55555	49984	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.689562082 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.689609051 CET	49984	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.746942997 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.748287916 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.751908064 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.754204035 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.797530890 CET	5651	49966	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:52.805530071 CET	465	49965	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.805581093 CET	8080	49967	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:52.851743937 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.853482962 CET	55555	49984	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.866938114 CET	465	49988	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.867856979 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.868201971 CET	55555	49989	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.868273020 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.868700027 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.868700027 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.868731976 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.870923996 CET	5651	49985	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.870949984 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.870999098 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.871637106 CET	49985	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.871809006 CET	5651	49990	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:52.874089003 CET	8080	49991	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:52.874177933 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.875786066 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.882224083 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.882236958 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.882304907 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.883776903 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:52.922336102 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:52.988687992 CET	465	49988	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.988707066 CET	55555	49989	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.988711119 CET	465	49988	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.990971088 CET	55555	49989	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:52.991561890 CET	5651	49985	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.054910898 CET	5651	49990	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:53.054958105 CET	5651	49990	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:53.055006981 CET	8080	49991	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:53.055016994 CET	8080	49991	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:53.055037022 CET	5651	49992	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.055831909 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.056457043 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.056477070 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.088860989 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.176482916 CET	5651	49992	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.176561117 CET	5651	49992	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.306497097 CET	5651	49986	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.306740999 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.306792021 CET	49986	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.360450029 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.457542896 CET	5651	49986	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.480382919 CET	5651	49993	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.480462074 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.481225967 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.481373072 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:53.601074934 CET	5651	49993	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.601219893 CET	5651	49993	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:53.868108988 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:54.088829041 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:54.883130074 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.088834047 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.452711105 CET	55555	49989	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.452773094 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.452815056 CET	49989	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.556232929 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.573720932 CET	55555	49989	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.676713943 CET	55555	49994	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.679862022 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.680633068 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.680649042 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.727652073 CET	5651	49992	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.727864027 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.728060961 CET	49992	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.765484095 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.800601006 CET	55555	49994	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.800622940 CET	55555	49994	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.848830938 CET	5651	49992	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.885531902 CET	5651	49995	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:55.885792971 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.887350082 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.887362957 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:55.899111986 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.008038044 CET	5651	49995	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.008102894 CET	5651	49995	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.078474998 CET	5651	49993	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.078572035 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.078685999 CET	49993	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.089091063 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.094579935 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.175097942 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:56.198625088 CET	5651	49993	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.214607000 CET	5651	49996	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.214704990 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.215229988 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.215241909 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.295139074 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:56.295245886 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:56.297629118 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:56.297648907 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:56.300137997 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:56.335151911 CET	5651	49996	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.335163116 CET	5651	49996	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.404364109 CET	55555	49975	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.404437065 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.404474974 CET	49975	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.418654919 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:56.418663025 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:56.418670893 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:56.420295000 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.461570978 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:56.524600983 CET	55555	49975	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.540335894 CET	55555	49998	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.540407896 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.542968988 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.543229103 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:56.662900925 CET	55555	49998	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.663103104 CET	55555	49998	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:56.914755106 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:57.088857889 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:57.306001902 CET	5655	49997	95.213.205.83	192.168.2.5
Dec 3, 2024 08:48:57.306288004 CET	49997	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:48:57.930202961 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.073235035 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.306092024 CET	55555	49994	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.306448936 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.306513071 CET	49994	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.396773100 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.426496983 CET	55555	49994	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.516874075 CET	55555	49999	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.516998053 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.517371893 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.517385960 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.519418955 CET	5651	49995	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.519546032 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.519714117 CET	49995	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.637408018 CET	55555	49999	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.637423992 CET	55555	49999	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.639575958 CET	5651	49995	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.650860071 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.770906925 CET	5651	50000	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.771922112 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.772217989 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.772234917 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.839098930 CET	5651	49996	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.839862108 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.839943886 CET	49996	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.892160892 CET	5651	50000	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.892167091 CET	5651	50000	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.945728064 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:58.960175991 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:58.960309029 CET	5651	49996	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.073303938 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.080502033 CET	5651	50001	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.080699921 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.085489035 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.086074114 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.186882019 CET	55555	49998	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.186960936 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.187000990 CET	49998	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.205364943 CET	5651	50001	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.205895901 CET	5651	50001	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.299030066 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.309714079 CET	55555	49998	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.419095039 CET	55555	50002	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.419190884 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.420051098 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.420063019 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.539963961 CET	55555	50002	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.540050983 CET	55555	50002	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.551492929 CET	8080	49967	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:59.551624060 CET	49967	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:59.567086935 CET	5651	49966	78.138.9.142	192.168.2.5
Dec 3, 2024 08:48:59.568770885 CET	49966	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:48:59.623330116 CET	465	49965	111.90.147.125	192.168.2.5
Dec 3, 2024 08:48:59.623434067 CET	49965	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:48:59.961529970 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:00.073234081 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:00.977257013 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.088886023 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.151230097 CET	55555	49999	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.154052019 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.154073000 CET	49999	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.232700109 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.274090052 CET	55555	49999	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.352750063 CET	55555	50003	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.352823973 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.359220982 CET	5651	50000	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.359311104 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.359467030 CET	50000	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.362351894 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.362361908 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.451427937 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.479676008 CET	5651	50000	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.482284069 CET	55555	50003	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.482328892 CET	55555	50003	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.571383953 CET	5651	50004	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.574057102 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.574275017 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.574285030 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.694725037 CET	5651	50004	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.694744110 CET	5651	50004	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.712574005 CET	5651	50001	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.714020967 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.714050055 CET	50001	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.746742010 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:01.783127069 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.833954096 CET	5651	50001	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.866612911 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:01.869908094 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:01.871583939 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:01.871684074 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:01.872642994 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:01.903049946 CET	5651	50006	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.903127909 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.904290915 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.904300928 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:01.978693962 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:01.991473913 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:01.991565943 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:01.991707087 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:02.024244070 CET	5651	50006	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.024280071 CET	5651	50006	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.033596992 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:02.048130989 CET	55555	50002	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.049909115 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.049947977 CET	50002	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.088901997 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.108752012 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.170038939 CET	55555	50002	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.228751898 CET	55555	50007	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.230026007 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.230319977 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.230334044 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:02.350281000 CET	55555	50007	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.350327015 CET	55555	50007	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:02.917284966 CET	5655	50005	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:02.917346001 CET	50005	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:02.993144989 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:03.074424982 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:03.986090899 CET	55555	50003	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:03.986170053 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:03.992989063 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.024912119 CET	50003	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.104490042 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.144902945 CET	55555	50003	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.199171066 CET	5651	50004	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.201843977 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.203113079 CET	50004	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.256988049 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.257241964 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.323045969 CET	5651	50004	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.376967907 CET	5651	50008	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.377090931 CET	55555	50009	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.377183914 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.378032923 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.410559893 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.410573006 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.410635948 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.410712004 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.502671003 CET	5651	50006	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.502784967 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.502784967 CET	50006	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.523477077 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.530721903 CET	5651	50008	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.530742884 CET	5651	50008	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.530787945 CET	55555	50009	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.530842066 CET	55555	50009	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.622821093 CET	5651	50006	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.643968105 CET	5651	50010	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.644037962 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.648597002 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.648674011 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.768637896 CET	5651	50010	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.768651009 CET	5651	50010	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.900768042 CET	55555	50007	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:04.900840998 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.900878906 CET	50007	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:04.951880932 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:05.008188963 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:05.021471977 CET	55555	50007	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:05.071902990 CET	55555	50011	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:05.073952913 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:05.074199915 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:05.074232101 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:05.088932037 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:05.194310904 CET	55555	50011	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:05.194324017 CET	55555	50011	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:06.025361061 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:06.088854074 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:06.970364094 CET	5651	50008	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:06.974088907 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:06.989213943 CET	50008	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.017071009 CET	55555	50009	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.017926931 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.035475969 CET	50009	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.055365086 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.109412909 CET	5651	50008	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.155484915 CET	55555	50009	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.249694109 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.249874115 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.276365042 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.279057026 CET	5651	50010	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.279113054 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.279228926 CET	50010	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.370506048 CET	5651	50012	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.370543003 CET	55555	50013	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.370629072 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.373871088 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.399159908 CET	5651	50010	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.406514883 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.406673908 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.406708002 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.406810045 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.407965899 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.496064901 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:07.526427031 CET	5651	50012	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.526658058 CET	55555	50013	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.526667118 CET	55555	50013	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.526674986 CET	5651	50012	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.528875113 CET	5651	50014	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.528942108 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.563528061 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.564631939 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.615968943 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:07.616036892 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:07.617122889 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:07.617316008 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:07.619522095 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:07.683370113 CET	5651	50014	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.684499979 CET	5651	50014	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.704200029 CET	55555	50011	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.704277039 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.704349995 CET	50011	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.737114906 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:07.737421989 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:07.737432003 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:07.785612106 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:07.795511961 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.824245930 CET	55555	50011	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.855092049 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.870933056 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:07.870934963 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:07.915496111 CET	55555	50016	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:07.915617943 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.921493053 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.921767950 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:07.924804926 CET	50017	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:07.926640987 CET	50018	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:07.926894903 CET	50019	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:08.017616987 CET	465	49988	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.033658028 CET	5651	49990	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.033668995 CET	8080	49991	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.041388035 CET	55555	50016	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.041635990 CET	55555	50016	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.044687986 CET	8080	50017	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.044759989 CET	50017	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.046442986 CET	50017	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.046443939 CET	50017	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.046479940 CET	5651	50018	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.046540022 CET	50018	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.046722889 CET	465	50019	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.046797037 CET	50019	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:08.048228979 CET	50018	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.048228979 CET	50018	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:08.048310995 CET	50019	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:08.048332930 CET	50019	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:08.070734024 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.167385101 CET	8080	50017	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.167397976 CET	8080	50017	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.169198036 CET	5651	50018	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.169207096 CET	5651	50018	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:08.169217110 CET	465	50019	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.169358015 CET	465	50019	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:08.276426077 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:08.664880991 CET	5655	50015	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:08.664952040 CET	50015	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:09.089782953 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:09.276819944 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:09.994420052 CET	55555	50013	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:09.997948885 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:09.998802900 CET	50013	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.000849962 CET	5651	50012	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.000922918 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.015382051 CET	50012	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.102297068 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.118710041 CET	55555	50013	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.132742882 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.132930040 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.135304928 CET	5651	50012	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.151288986 CET	5651	50014	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.151380062 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.152053118 CET	50014	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.203546047 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.252774954 CET	5651	50020	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.252850056 CET	55555	50021	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.252932072 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.254916906 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.262259007 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.262271881 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.262315989 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.262348890 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.271905899 CET	5651	50014	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.276376963 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.323523998 CET	5651	50022	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.323673010 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.330780029 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.330780029 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.382299900 CET	5651	50020	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.382311106 CET	5651	50020	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.382328033 CET	55555	50021	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.382345915 CET	55555	50021	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.450767040 CET	5651	50022	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.450776100 CET	5651	50022	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.589390039 CET	55555	50016	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.589478970 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.589529991 CET	50016	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.640377998 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.709472895 CET	55555	50016	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.760742903 CET	55555	50023	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.761969090 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.762967110 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.762979984 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:10.882893085 CET	55555	50023	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:10.882915974 CET	55555	50023	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:11.117326021 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:11.276376963 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:12.133595943 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:12.276432991 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:12.877507925 CET	5651	50020	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:12.879873991 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:12.915731907 CET	55555	50021	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:12.915798903 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:12.923376083 CET	5651	50022	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:12.923438072 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:13.150113106 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:13.276587963 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:13.361218929 CET	55555	50023	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:13.362517118 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:14.164774895 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:14.385955095 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:14.779882908 CET	465	49988	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:14.779939890 CET	49988	465	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:14.793576956 CET	8080	49991	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:14.794212103 CET	49991	8080	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:14.803724051 CET	5651	49990	78.138.9.142	192.168.2.5
Dec 3, 2024 08:49:14.803791046 CET	49990	5651	192.168.2.5	78.138.9.142
Dec 3, 2024 08:49:15.180325985 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:15.229469061 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:16.195723057 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:16.245116949 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:17.211978912 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:17.260735035 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:18.227633953 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:18.276355982 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:19.242338896 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:19.291975021 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.259980917 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.307610035 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.763891935 CET	50020	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.763942957 CET	50021	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.764964104 CET	50022	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.765618086 CET	50023	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.865797043 CET	50024	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.866142035 CET	50025	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.884042025 CET	55555	50021	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.884083986 CET	5651	50020	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.884793997 CET	5651	50022	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.886178017 CET	55555	50023	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.980495930 CET	50026	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:20.985866070 CET	5651	50024	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.986011982 CET	50024	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.986044884 CET	55555	50025	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:20.986110926 CET	50025	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.986239910 CET	50024	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.986239910 CET	50024	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.986341000 CET	50025	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:20.986341000 CET	50025	55555	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:21.100472927 CET	5655	50026	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:21.100599051 CET	50026	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:21.101567030 CET	50026	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:21.101833105 CET	50026	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:21.106332064 CET	5651	50024	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:21.106446981 CET	5651	50024	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:21.106453896 CET	55555	50025	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:21.106458902 CET	55555	50025	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:21.221662045 CET	5655	50026	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:21.221960068 CET	5655	50026	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:21.221976042 CET	5655	50026	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:21.274818897 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:21.323239088 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:22.289858103 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:22.338865995 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:22.823272943 CET	5655	50026	95.213.205.83	192.168.2.5
Dec 3, 2024 08:49:22.870127916 CET	50026	5655	192.168.2.5	95.213.205.83
Dec 3, 2024 08:49:23.305179119 CET	80	49803	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:23.354521036 CET	49803	80	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:23.611970901 CET	5651	50024	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:23.612143993 CET	50024	5651	192.168.2.5	111.90.147.125
Dec 3, 2024 08:49:23.618627071 CET	55555	50025	111.90.147.125	192.168.2.5
Dec 3, 2024 08:49:23.618695974 CET	50025	55555	192.168.2.5	111.90.147.125

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 08:47:41.377574921 CET	53378	53	192.168.2.5	1.1.1.1
Dec 3, 2024 08:47:42.068829060 CET	53	53378	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 08:47:41.377574921 CET	192.168.2.5	1.1.1.1	0x563	Standard query (0)	id72.internetid.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 08:47:27.076615095 CET	1.1.1.1	192.168.2.5	0x292d	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 08:47:39.867738962 CET	1.1.1.1	192.168.2.5	0xb621	No error (0)	prod.globalsign.map.fastly.net		151.101.130.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:47:39.867738962 CET	1.1.1.1	192.168.2.5	0xb621	No error (0)	prod.globalsign.map.fastly.net		151.101.66.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:47:39.867738962 CET	1.1.1.1	192.168.2.5	0xb621	No error (0)	prod.globalsign.map.fastly.net		151.101.194.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:47:39.867738962 CET	1.1.1.1	192.168.2.5	0xb621	No error (0)	prod.globalsign.map.fastly.net		151.101.2.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:47:42.068829060 CET	1.1.1.1	192.168.2.5	0x563	No error (0)	id72.internetid.ru	main.internetid.ru		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 08:47:42.068829060 CET	1.1.1.1	192.168.2.5	0x563	No error (0)	main.internetid.ru		95.213.205.83	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:48:22.546601057 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:48:22.546601057 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49803	111.90.147.125	80	7864	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 08:47:36.668247938 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Dec 3, 2024 08:47:36.668265104 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Dec 3, 2024 08:47:38.232934952 CET	4	IN	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 08:47:38.233238935 CET	6	OUT	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 08:47:38.233262062 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 3, 2024 08:47:38.233272076 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Dec 3, 2024 08:47:38.233292103 CET	6	OUT	Data Raw: 00 00 00 2e Data Ascii: .
Dec 3, 2024 08:47:38.233328104 CET	46	OUT	Data Raw: 22 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 20 00 6e 00 61 00 6d 00 65 00 3a 00 20 00 33 00 30 00 31 00 33 00 38 00 39 00 22 00 Data Ascii: "Computer name: 301389"
Dec 3, 2024 08:47:38.788727999 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:
Dec 3, 2024 08:47:39.789566040 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	02:47:04
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\442.docx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\442.docx.exe"
Imagebase:	0x7ff7c99a0000
File size:	25'141'051 bytes
MD5 hash:	FB8117B1A3F0924100FBC209DBBB1BB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:47:06
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Imagebase:	0x7ff659560000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:47:06
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff659560000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:47:07
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Imagebase:	0xb60000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:47:08
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 684489E62C864DF5C283E9DB67C8FC1A
Imagebase:	0x600000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:47:10
Start date:	03/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:47:14
Start date:	03/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:47:18
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Imagebase:	0xc70000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000C.00000000.2172554360.0000000001725000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:47:22
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Imagebase:	0xb10000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000E.00000000.2219293441.0000000001FD1000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:47:28
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0xb10000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:47:30
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Imagebase:	0xb10000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:47:32
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Imagebase:	0xb10000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000011.00000002.3317620536.0000000002198000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:47:33
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0xb10000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:47:34
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Imagebase:	0xc70000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3304532933.000000000206A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3304532933.0000000002046000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	02:47:34
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0xc70000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000014.00000002.3309338966.0000000003858000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000014.00000002.3320249204.0000000005420000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000014.00000002.3309338966.000000000388A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000014.00000002.3320249204.0000000005464000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	02:47:43
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0xc70000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF7C99CB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99A255C: GetDlgItem.USER32 ref: 00007FF7C99A25AC
Part of subcall function 00007FF7C99A255C: SetWindowTextW.USER32 ref: 00007FF7C99A25C8

EndDialog.USER32 ref: 00007FF7C99CB2D0
SetDlgItemTextW.USER32 ref: 00007FF7C99CB320
GetMessageW.USER32 ref: 00007FF7C99CB350
IsDialogMessageW.USER32 ref: 00007FF7C99CB369
TranslateMessage.USER32 ref: 00007FF7C99CB37B
DispatchMessageW.USER32 ref: 00007FF7C99CB389
EndDialog.USER32 ref: 00007FF7C99CB3D3
GetDlgItem.USER32 ref: 00007FF7C99CB410
SendMessageW.USER32 ref: 00007FF7C99CB431
SendMessageW.USER32 ref: 00007FF7C99CB449
SetFocus.USER32 ref: 00007FF7C99CB452
GetLastError.KERNEL32 ref: 00007FF7C99CB634
GetLastError.KERNEL32 ref: 00007FF7C99CB665
GetTickCount.KERNEL32 ref: 00007FF7C99CB68B
GetLastError.KERNEL32 ref: 00007FF7C99CB6F5
GetCommandLineW.KERNEL32 ref: 00007FF7C99CB841
CreateFileMappingW.KERNEL32 ref: 00007FF7C99CB900
MapViewOfFile.KERNEL32 ref: 00007FF7C99CB923
Sleep.KERNEL32 ref: 00007FF7C99CB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF7C99CB9DF
CloseHandle.KERNEL32 ref: 00007FF7C99CB9E8
SetDlgItemTextW.USER32 ref: 00007FF7C99CBCDE
DialogBoxParamW.USER32 ref: 00007FF7C99CC0D7
EndDialog.USER32 ref: 00007FF7C99CC0EF
EnableWindow.USER32 ref: 00007FF7C99CC2A6
SendMessageW.USER32 ref: 00007FF7C99CC2F8
ShellExecuteExW.SHELL32 ref: 00007FF7C99CB95B

Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB67
Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB80

SendMessageW.USER32 ref: 00007FF7C99CBEC3
SendDlgItemMessageW.USER32 ref: 00007FF7C99CBEEA
GetDlgItem.USER32 ref: 00007FF7C99CBEF8
SendMessageW.USER32 ref: 00007FF7C99CBF12
GetDlgItem.USER32 ref: 00007FF7C99CBF4F
SetDlgItemTextW.USER32 ref: 00007FF7C99CBFEC
SetDlgItemTextW.USER32 ref: 00007FF7C99CC004
SetDlgItemTextW.USER32 ref: 00007FF7C99CC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CC381
SendDlgItemMessageW.USER32 ref: 00007FF7C99CC449
EndDialog.USER32 ref: 00007FF7C99CC463
GetDlgItem.USER32 ref: 00007FF7C99CC491
SetFocus.USER32 ref: 00007FF7C99CC49A
SendDlgItemMessageW.USER32 ref: 00007FF7C99CC53E
FindFirstFileW.KERNEL32 ref: 00007FF7C99CC562
FindClose.KERNEL32 ref: 00007FF7C99CC68A
SendDlgItemMessageW.USER32 ref: 00007FF7C99CC7AF

Part of subcall function 00007FF7C99A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CCAC7

Strings

@, xrefs: 00007FF7C99CB7B6
__tmp_rar_sfx_access_check_, xrefs: 00007FF7C99CB6A9
STARTDLG, xrefs: 00007FF7C99CB1CA
runas, xrefs: 00007FF7C99CB7C9
LICENSEDLG, xrefs: 00007FF7C99CC0C9
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7C99CB799
REPLACEFILEDLG, xrefs: 00007FF7C99CC3D3
%s %s, xrefs: 00007FF7C99CC6D9, 00007FF7C99CC946
p, xrefs: 00007FF7C99CB7AB
winrarsfxmappingfile.tmp, xrefs: 00007FF7C99CB8E0

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: e5fb430667728f95dc108dbc90c1f453d2168efe69669e82241350e9cacaa09f
Instruction ID: 91dc3fb1b6d049ca0c153a1b15972959f7104b390bac41c8213b38e1c987b1a0
Opcode Fuzzy Hash: e5fb430667728f95dc108dbc90c1f453d2168efe69669e82241350e9cacaa09f
Instruction Fuzzy Hash: 65D29062A0868281EBA0BF25EC546B9FF71EFC67A0FD05531D94D076A5EE3CE544CB20

Function 00007FF7C99CCE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7C99CD5F3
SendMessageW.USER32 ref: 00007FF7C99CD626
SendMessageW.USER32 ref: 00007FF7C99CD655
MoveFileW.KERNEL32 ref: 00007FF7C99CDB4B
MoveFileExW.KERNEL32 ref: 00007FF7C99CDB69
GetTempPathW.KERNEL32 ref: 00007FF7C99CDC49

Part of subcall function 00007FF7C99A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1FFB

EndDialog.USER32 ref: 00007FF7C99CDFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99CEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99CEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99CEF73

Strings

MAX, xrefs: 00007FF7C99CEA82, 00007FF7C99CEA91
.tmp, xrefs: 00007FF7C99CDA85
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7C99CD501
<br>, xrefs: 00007FF7C99CD6DA, 00007FF7C99CD6E9
.lnk, xrefs: 00007FF7C99CE406, 00007FF7C99CE415
HIDE, xrefs: 00007FF7C99CE9E5, 00007FF7C99CE9F4
@set:user, xrefs: 00007FF7C99CDD96, 00007FF7C99CDDA5
MIN, xrefs: 00007FF7C99CEAE5, 00007FF7C99CEAF4
lnk, xrefs: 00007FF7C99CE3CA, 00007FF7C99CE3D9
ProgramFilesDir, xrefs: 00007FF7C99CD4F0

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 01475848ce634a14826cd04c53170e3b16a21078ef098113d3159c7b50329371
Instruction ID: 3bc5af3638eb89012eeff31e71f5265db648b8802e283350d540de3f60b34c1e
Opcode Fuzzy Hash: 01475848ce634a14826cd04c53170e3b16a21078ef098113d3159c7b50329371
Instruction Fuzzy Hash: 2813B372B0478299EB90EF64D8442EC7BB1EB807A8FD01535DA5D17AE9DF38E584C360

Function 00007FF7C99D0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C99BDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE018
Part of subcall function 00007FF7C99BDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE030
Part of subcall function 00007FF7C99BDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE05D

Part of subcall function 00007FF7C99B62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C99B62F2
Part of subcall function 00007FF7C99B62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C99B632C

Part of subcall function 00007FF7C99C946C: OleInitialize.OLE32 ref: 00007FF7C99C9486
Part of subcall function 00007FF7C99C946C: SHGetMalloc.SHELL32 ref: 00007FF7C99C94D4

GetCommandLineW.KERNEL32 ref: 00007FF7C99D096E
OpenFileMappingW.KERNEL32 ref: 00007FF7C99D0A07
MapViewOfFile.KERNEL32 ref: 00007FF7C99D0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF7C99D0A46
MapViewOfFile.KERNEL32 ref: 00007FF7C99D0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF7C99D0ACA
CloseHandle.KERNEL32 ref: 00007FF7C99D0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7C99D0BAD
GetLocalTime.KERNEL32 ref: 00007FF7C99D0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99D0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7C99D0C26
GetModuleHandleW.KERNEL32 ref: 00007FF7C99D0C2E
LoadIconW.USER32 ref: 00007FF7C99D0C4D
DialogBoxParamW.USER32 ref: 00007FF7C99D0CB6
Sleep.KERNEL32 ref: 00007FF7C99D0CE6
DeleteObject.GDI32 ref: 00007FF7C99D0D0D
DeleteObject.GDI32 ref: 00007FF7C99D0D1F
CloseHandle.KERNEL32 ref: 00007FF7C99D0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D0DE3

Part of subcall function 00007FF7C99CFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7C99CFD43
Part of subcall function 00007FF7C99CFD0C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF7C99CFDBC

Strings

sfxstime, xrefs: 00007FF7C99D0C1F
sfxname, xrefs: 00007FF7C99D0B9B
STARTDLG, xrefs: 00007FF7C99D0CA5
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF7C99D0C02
winrarsfxmappingfile.tmp, xrefs: 00007FF7C99D09F9

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: fcdfd6d8174970b9a236f1ff0dd38d9f465d88258eb4dfcd8f653860d12c6cc7
Instruction ID: 76aa6a16709bcdcf40f367e3bb26c852d5e8b9f7d3fbc7020f203ae1fee9ca06
Opcode Fuzzy Hash: fcdfd6d8174970b9a236f1ff0dd38d9f465d88258eb4dfcd8f653860d12c6cc7
Instruction Fuzzy Hash: 42127662A0878285EB90AF25E84527DFB71FFC57A4F805131DA9D47AA5DF3CE140C720

Function 00007FF7C99BA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99BA504

Part of subcall function 00007FF7C99C0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7C99C0F99

SetDlgItemTextW.USER32 ref: 00007FF7C99BA573
GetWindowRect.USER32 ref: 00007FF7C99BA5AD
GetClientRect.USER32 ref: 00007FF7C99BA5BB
GetWindowLongPtrW.USER32 ref: 00007FF7C99BA66C
GetWindowRect.USER32 ref: 00007FF7C99BA6B2
SetWindowTextW.USER32 ref: 00007FF7C99BA6EC
GetSystemMetrics.USER32 ref: 00007FF7C99BA6F7
GetWindow.USER32 ref: 00007FF7C99BA708
GetWindowRect.USER32 ref: 00007FF7C99BA746
GetWindow.USER32 ref: 00007FF7C99BA808

Strings

$%s:, xrefs: 00007FF7C99BA4EF
CAPTION, xrefs: 00007FF7C99BA6CF

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 6188d4b4c2a65839a4394e903f923f32112dfab9eada3aa265484d337704ab42
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 2D91D532A1864186E798AF39A80066DFBB1FBC8794F945535EE4E47B58DE3CE805CB10

Function 00007FF7C99C8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF7C99C863D
SizeofResource.KERNEL32 ref: 00007FF7C99C8659
LoadResource.KERNEL32 ref: 00007FF7C99C8673
LockResource.KERNEL32 ref: 00007FF7C99C8685
GlobalAlloc.KERNELBASE ref: 00007FF7C99C86A6
GlobalLock.KERNEL32 ref: 00007FF7C99C86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF7C99C86E8
GdipAlloc.GDIPLUS ref: 00007FF7C99C86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7C99C8769
GlobalUnlock.KERNEL32 ref: 00007FF7C99C878C
GlobalFree.KERNEL32 ref: 00007FF7C99C8795

Strings

PNG, xrefs: 00007FF7C99C862F

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: cec6d2b445a851b347b9f1467aef74af79eb6b2481462bc38318f1a405eac10c
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: A0410B25A19A0282EF84AF679854379ABB4AFC8BE4F844475CA0D47364EE7CE449C720

Function 00007FF7C99AF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1263

Strings

__tmp_reference_source_, xrefs: 00007FF7C99AFCCF, 00007FF7C99AFCDE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: f93a5901f091a80e527cf63f7fd92bb3ffac14f30fe3de6cd4a58ad4180e2ab3
Instruction ID: 7e8407c6e77d05a4503745baa0a80205de145eeed5bfb6da9ee55ad95d7b3413
Opcode Fuzzy Hash: f93a5901f091a80e527cf63f7fd92bb3ffac14f30fe3de6cd4a58ad4180e2ab3
Instruction Fuzzy Hash: 45E28362A086C292EBB4AF65D1443AEEB71FBC17A4F804132DB9D036A5CF3CE554C724

Function 00007FF7C99A4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A5E1C

Strings

CMT, xrefs: 00007FF7C99A59B2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: f3c9c95c157df1c99ad266365504da1f39fa52ba75423407634179f88c0c16ad
Instruction ID: 1d627b2d98d25cf15aeadb9573940d2d121de5ee5fe09ce7e2c911084a6fde16
Opcode Fuzzy Hash: f3c9c95c157df1c99ad266365504da1f39fa52ba75423407634179f88c0c16ad
Instruction Fuzzy Hash: 76E2F422B0868286EBA4EF75D5502FDEBB1FB857A4F840035DA9E47696DF3CE054C321

Function 00007FF7C99B40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7C99B410B
FindFirstFileW.KERNELBASE ref: 00007FF7C99B415E
GetLastError.KERNEL32 ref: 00007FF7C99B41AF
FindNextFileW.KERNEL32 ref: 00007FF7C99B41D7
GetLastError.KERNEL32 ref: 00007FF7C99B41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B4315

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: b636778bc37e3feeb860f5fd15a6bca11a928d4e4d3c0f47340126a0b9d33c1e
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: 4E61A372A08A4681DB60AF25E8842ADA771FBD5BB4F904331EEAD076D9DF3CD584C710

Function 00007FF7C99A5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF7C99A59B2, 00007FF7C99A675B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction ID: bcb3c9b294c4187b382f75c744c4a25e8da274c74efcf055675db77dabedc73e
Opcode Fuzzy Hash: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction Fuzzy Hash: 4142D222B086819AEB98EF75C1502FDBBB1EB95764F800135DB9E53696DF3CE518C320

Function 00007FF7C99C1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cc9b5d49baee892d39d1da46008d2b4229947a5b0a2c39888c4d08721f4c94
Instruction ID: 984bc524204596037e6a3706a88f5fb7df7abd692f2481abf966913d99e6fedd
Opcode Fuzzy Hash: 00cc9b5d49baee892d39d1da46008d2b4229947a5b0a2c39888c4d08721f4c94
Instruction Fuzzy Hash: CAE1F722B082828BFBB4EF29984427DBFA1FB84798F854135DB4E57785DE3CE5418B14

Function 00007FF7C99C3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction ID: 04fd18485a12f5f3212b38d879237ef13b50793ef14cf05d286acc62d52b3660
Opcode Fuzzy Hash: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction Fuzzy Hash: A8B1EFA2B047C992DF98EF66DA096E9A7A5B784BD4F848032DE0D07B40DF3CE155C710

Function 00007FF7C99B4928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction ID: 02abfaa024e4d4d70eea59a19a1b63bf8c7e62ae95c898a9d4ded78d666772ca
Opcode Fuzzy Hash: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction Fuzzy Hash: D9413832B1569286FBB4EF26E94476AAB62FBC4B94F848030DE0D07795CE3CE442C354

Function 00007FF7C99BDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE05D
CreateFileW.KERNEL32 ref: 00007FF7C99BE3F0
SetFilePointer.KERNEL32 ref: 00007FF7C99BE40E
ReadFile.KERNEL32 ref: 00007FF7C99BE436

Part of subcall function 00007FF7C99BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7C99BDDDF

CompareStringW.KERNELBASE ref: 00007FF7C99BE559
CloseHandle.KERNEL32 ref: 00007FF7C99BE4F3

Part of subcall function 00007FF7C99A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1FFB

Part of subcall function 00007FF7C99B51A4: GetVersionExW.KERNEL32 ref: 00007FF7C99B51D5

Part of subcall function 00007FF7C99BDFD0: LoadLibraryExW.KERNELBASE ref: 00007FF7C99BDEFF
Part of subcall function 00007FF7C99BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BDFB5
Part of subcall function 00007FF7C99BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BDFBB
Part of subcall function 00007FF7C99BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BDFC1
Part of subcall function 00007FF7C99BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7C99BE7AA
ExitProcess.KERNEL32 ref: 00007FF7C99BE7BB

Strings

aclui.dll, xrefs: 00007FF7C99BE371
SSPICLI.DLL, xrefs: 00007FF7C99BE09C
dhcpcsvc6.dll, xrefs: 00007FF7C99BE31D
ntshrui.dll, xrefs: 00007FF7C99BE12B
mpr.dll, xrefs: 00007FF7C99BE291
dwmapi.dll, xrefs: 00007FF7C99BE0BD, 00007FF7C99BE661
WindowsCodecs.dll, xrefs: 00007FF7C99BE213
apphelp.dll, xrefs: 00007FF7C99BE14F
secur32.dll, xrefs: 00007FF7C99BE1CD
dnsapi.DLL, xrefs: 00007FF7C99BE259
ieframe.dll, xrefs: 00007FF7C99BE120
usp10.dll, xrefs: 00007FF7C99BE0DE
userenv.dll, xrefs: 00007FF7C99BE15D
profapi.dll, xrefs: 00007FF7C99BE205
shell32.dll, xrefs: 00007FF7C99BE1BF
dfscli.dll, xrefs: 00007FF7C99BE2F3
atl.dll, xrefs: 00007FF7C99BE136
linkinfo.dll, xrefs: 00007FF7C99BE347
cryptbase.dll, xrefs: 00007FF7C99BE0C8
shdocvw.dll, xrefs: 00007FF7C99BE179
samcli.dll, xrefs: 00007FF7C99BE2C9
samlib.dll, xrefs: 00007FF7C99BE2D7
srvcli.dll, xrefs: 00007FF7C99BE221
setupapi.dll, xrefs: 00007FF7C99BE141
SetDefaultDllDirectories, xrefs: 00007FF7C99BE053
cryptui.dll, xrefs: 00007FF7C99BE1A3
netutils.dll, xrefs: 00007FF7C99BE283
devrtl.dll, xrefs: 00007FF7C99BE29F
crypt32.dll, xrefs: 00007FF7C99BE187
ws2_32.dll, xrefs: 00007FF7C99BE0FF
SetDllDirectoryW, xrefs: 00007FF7C99BE026
cabinet.dll, xrefs: 00007FF7C99BE1DB
oleaccrc.dll, xrefs: 00007FF7C99BE1E9
wkscli.dll, xrefs: 00007FF7C99BE2E5
propsys.dll, xrefs: 00007FF7C99BE2AD
slc.dll, xrefs: 00007FF7C99BE23D
dhcpcsvc.dll, xrefs: 00007FF7C99BE32B
DXGIDebug.dll, xrefs: 00007FF7C99BE086, 00007FF7C99BE5B6
netapi32.dll, xrefs: 00007FF7C99BE16B
UXTheme.dll, xrefs: 00007FF7C99BE0B2
wintrust.dll, xrefs: 00007FF7C99BE1B1
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF7C99BE73B
comres.dll, xrefs: 00007FF7C99BE0F4
peerdist.dll, xrefs: 00007FF7C99BE38D
RpcRtRemote.dll, xrefs: 00007FF7C99BE363
XmlLite.dll, xrefs: 00007FF7C99BE339
sfc_os.dll, xrefs: 00007FF7C99BE091
WINNSI.DLL, xrefs: 00007FF7C99BE275
psapi.dll, xrefs: 00007FF7C99BE115
ntmarta.dll, xrefs: 00007FF7C99BE1F7
mlang.dll, xrefs: 00007FF7C99BE2BB
iphlpapi.DLL, xrefs: 00007FF7C99BE267
uxtheme.dll, xrefs: 00007FF7C99BE66D
browcli.dll, xrefs: 00007FF7C99BE301
cryptsp.dll, xrefs: 00007FF7C99BE355
rasadhlp.dll, xrefs: 00007FF7C99BE30F
version.dll, xrefs: 00007FF7C99BE07B
kernel32, xrefs: 00007FF7C99BE011
cscapi.dll, xrefs: 00007FF7C99BE22F
imageres.dll, xrefs: 00007FF7C99BE24B
rsaenh.dll, xrefs: 00007FF7C99BE0A7
clbcatq.dll, xrefs: 00007FF7C99BE0E9
dsrole.dll, xrefs: 00007FF7C99BE37F
lpk.dll, xrefs: 00007FF7C99BE0D3
msasn1.dll, xrefs: 00007FF7C99BE195
ws2help.dll, xrefs: 00007FF7C99BE10A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction ID: aa114c5e978f540241b16b79c55d7f12e4ef38d8989d8862f06f68b7a4523cee
Opcode Fuzzy Hash: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction Fuzzy Hash: 50321D35A09F8299EBA1AF64E8401E9B7B8FF84364FD00236DA4D06765EF3CD655C360

Function 00007FF7C99B98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99B8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99B9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99BA435

Part of subcall function 00007FF7C99C0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7C99C0B44), ref: 00007FF7C99C0BE9

Strings

,, xrefs: 00007FF7C99B9FAA
@%s:, xrefs: 00007FF7C99B9F57
DIRECTION, xrefs: 00007FF7C99B9DE5
, xrefs: 00007FF7C99B9DF9
RTL, xrefs: 00007FF7C99B9F2E
*messages***, xrefs: 00007FF7C99B9C04
*messages***, xrefs: 00007FF7C99B9BC6
STRINGS, xrefs: 00007FF7C99B9DC1
DIALOG, xrefs: 00007FF7C99B9DCD
$%s:, xrefs: 00007FF7C99B9F50
MENU, xrefs: 00007FF7C99B9DD9

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 3b26f4d226c81ed995e550c10dd8d2e0a3396c4394cac7f732fcd1ca91b42b00
Instruction ID: baccd5c9e62e43330c3207baf9c931d2926b839f23170ec5eb2f9156433f3b50
Opcode Fuzzy Hash: 3b26f4d226c81ed995e550c10dd8d2e0a3396c4394cac7f732fcd1ca91b42b00
Instruction Fuzzy Hash: 1762A022A1968285EBA0EF25C4882BDFBB1FB957A8FC04131DE4D47695EF3DE544C360

Function 00007FF7C99D1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C99D1558: DloadProtectSection.DELAYIMP ref: 00007FF7C99D15C9

RaiseException.KERNEL32 ref: 00007FF7C99D19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7C99D1993

Part of subcall function 00007FF7C99D1868: DloadProtectSection.DELAYIMP ref: 00007FF7C99D18C7

LoadLibraryExA.KERNELBASE ref: 00007FF7C99D1A46
GetLastError.KERNEL32 ref: 00007FF7C99D1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7C99D1A86
RaiseException.KERNEL32 ref: 00007FF7C99D1A9A

Strings

H, xrefs: 00007FF7C99D1974

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 6e9404fb1779014aec5835cce6c677f61b19a763a09ac0b4787e214cc4c845cd
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 8D914E33B09B518AEB94EFA6D8842A8B7B1BB48BA4F844535DE0D17754EF38E545C320

Function 00007FF7C99CF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF7C99CF747
ShowWindow.USER32 ref: 00007FF7C99CF786
GetExitCodeProcess.KERNEL32 ref: 00007FF7C99CF7BD
CloseHandle.KERNEL32 ref: 00007FF7C99CF7E7
ShowWindow.USER32 ref: 00007FF7C99CF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CF8FB

Strings

Install, xrefs: 00007FF7C99CF684
p, xrefs: 00007FF7C99CF529
.exe, xrefs: 00007FF7C99CF7F2
.inf, xrefs: 00007FF7C99CF675

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: fd3b58b5eb305c00c83d38e58d9e4083d0156c4e785351e455ab425b01f70423
Instruction ID: 88f350dccccad8144b7cd8747872514c49da2af641446f546dc728d2817729e6
Opcode Fuzzy Hash: fd3b58b5eb305c00c83d38e58d9e4083d0156c4e785351e455ab425b01f70423
Instruction Fuzzy Hash: B5C18B22F08A4295FB90AF25D94027DBBB1AFC5BA0F845031DA4E47AA5DF3CE461C720

Function 00007FF7C99CF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C99CAE1C: PeekMessageW.USER32 ref: 00007FF7C99CAE32
Part of subcall function 00007FF7C99CAE1C: GetMessageW.USER32 ref: 00007FF7C99CAE49
Part of subcall function 00007FF7C99CAE1C: IsDialogMessageW.USER32 ref: 00007FF7C99CAE60
Part of subcall function 00007FF7C99CAE1C: TranslateMessage.USER32 ref: 00007FF7C99CAE6F
Part of subcall function 00007FF7C99CAE1C: DispatchMessageW.USER32 ref: 00007FF7C99CAE7A

GetDlgItem.USER32 ref: 00007FF7C99CF0E3
ShowWindow.USER32 ref: 00007FF7C99CF109
SendMessageW.USER32 ref: 00007FF7C99CF11E
SendMessageW.USER32 ref: 00007FF7C99CF136
SendMessageW.USER32 ref: 00007FF7C99CF157
SendMessageW.USER32 ref: 00007FF7C99CF173
SendMessageW.USER32 ref: 00007FF7C99CF1B6
SendMessageW.USER32 ref: 00007FF7C99CF1D4
SendMessageW.USER32 ref: 00007FF7C99CF1E8
SendMessageW.USER32 ref: 00007FF7C99CF212
SendMessageW.USER32 ref: 00007FF7C99CF22A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: 0168b1f96f9493ff90cf9ba3ab4c450abba5abfe3081512c7dc846a484908318
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: 5D41BF21B1464286F784AF71E810BAE7F70EB89BA8F942135DD0A07B95CE3DD449CB64

Function 00007FF7C99AEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF572

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3982dfa35720f311290c569a92371854ba117263ca7aa152baa728957ab7fb83
Instruction ID: c0262140f207e537def49403f8d849387512a4a19c6dc19210fccdc89b8281de
Opcode Fuzzy Hash: 3982dfa35720f311290c569a92371854ba117263ca7aa152baa728957ab7fb83
Instruction Fuzzy Hash: A012AF62F08B4185EB50AF65D4442BDAB71EB857B8F800232DE9D17AE9DF3CE595C320

Function 00007FF7C99B24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7C99B259B
GetLastError.KERNEL32 ref: 00007FF7C99B25AE
CreateFileW.KERNEL32 ref: 00007FF7C99B260E
GetLastError.KERNEL32 ref: 00007FF7C99B2617
SetFileTime.KERNEL32 ref: 00007FF7C99B26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B2736

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: b9585f1c58667082701a0102b1b5d55728d65cd81e15d6251f56b29b141909b9
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: C0610362A1868185E7609F29E44436EABB1FBD5BB8F500335DFAD03AD8CF3DD0548714

Function 00007FF7C99CFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7C99CFD43
SetEnvironmentVariableW.KERNELBASE ref: 00007FF7C99CFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CFE1B

Strings

sfxpar, xrefs: 00007FF7C99CFDB5
sfxcmd, xrefs: 00007FF7C99CFD3C

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 759fab0cd620d973dd901fc7fce65609fac5fc133775afd8a177ca93e5c0e352
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: 1B319072A18A0585FB44EF65E8841ACB771FB88BA8F940131DE5E177A9DF38D051C364

Function 00007FF7C99CB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF7C99CB02A
GetObjectW.GDI32 ref: 00007FF7C99CB05B
DeleteObject.GDI32 ref: 00007FF7C99CB095
DeleteObject.GDI32 ref: 00007FF7C99CB0C5

Part of subcall function 00007FF7C99C8624: FindResourceExW.KERNELBASE ref: 00007FF7C99C863D
Part of subcall function 00007FF7C99C8624: SizeofResource.KERNEL32 ref: 00007FF7C99C8659
Part of subcall function 00007FF7C99C8624: LoadResource.KERNEL32 ref: 00007FF7C99C8673
Part of subcall function 00007FF7C99C8624: LockResource.KERNEL32 ref: 00007FF7C99C8685
Part of subcall function 00007FF7C99C8624: GlobalAlloc.KERNELBASE ref: 00007FF7C99C86A6
Part of subcall function 00007FF7C99C8624: GlobalLock.KERNEL32 ref: 00007FF7C99C86BB
Part of subcall function 00007FF7C99C8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF7C99C86E8
Part of subcall function 00007FF7C99C8624: GdipAlloc.GDIPLUS ref: 00007FF7C99C86FE
Part of subcall function 00007FF7C99C8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7C99C8769
Part of subcall function 00007FF7C99C8624: GlobalUnlock.KERNEL32 ref: 00007FF7C99C878C
Part of subcall function 00007FF7C99C8624: GlobalFree.KERNEL32 ref: 00007FF7C99C8795

Strings

], xrefs: 00007FF7C99CB063

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: fa7d2019c9536e4d1e0e85ed846c6d2c447e32661aa65aa5940d3947d289c104
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 6F115721B0964242EBD4FF239A54279EAB19FC9BE0F980074D95D07B9ADE2CE814CB10

Function 00007FF7C99CAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7C99CAE32
GetMessageW.USER32 ref: 00007FF7C99CAE49
IsDialogMessageW.USER32 ref: 00007FF7C99CAE60
TranslateMessage.USER32 ref: 00007FF7C99CAE6F
DispatchMessageW.USER32 ref: 00007FF7C99CAE7A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: bc0298be4b70b84f1f7f54caa875d7acbe9cd3dc30922782f6462ab627230ec9
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 99F01921A2854282EBD0AF24E895E3AB771BFE4B54FD06031E54F82854DE2CD508DA10

Function 00007FF7C99C91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF7C99C9211
SHAutoComplete.SHLWAPI ref: 00007FF7C99C9255

Part of subcall function 00007FF7C99C13C4: CompareStringW.KERNEL32 ref: 00007FF7C99C13E3

FindWindowExW.USER32 ref: 00007FF7C99C923F

Strings

EDIT, xrefs: 00007FF7C99C921B, 00007FF7C99C9233

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 0b19232530abebc91ae8587f82c77bbf521d620d24cec198908685b497340c73
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: FD016221B18A4381FBA4AF21AC107B5F7B0AFE9764FC41031C94E07655DE2CD149CA70

Function 00007FF7C99B2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF7C99B8C9A), ref: 00007FF7C99B2D22
WriteFile.KERNEL32 ref: 00007FF7C99B2D6C
WriteFile.KERNELBASE ref: 00007FF7C99B2D9A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: 4475296109fb3c93e61445d960ac874358f022c4b2f101889061adba62ee5693
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: D951E622A1958692EBA0AF26D44477EAB70FFE5BB0F941131EE4E06690DF3CD485C321

Function 00007FF7C99D03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF7C99D0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D05CD

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: dd20fbc03e7b4ed3df35e7997b11e4c7c519625834bd32e30ad2cbcd1638632d
Instruction ID: 32b9567dc69896128ba88d6ef8c212433ff4dc63fb5b468f0dc3176b7ef47996
Opcode Fuzzy Hash: dd20fbc03e7b4ed3df35e7997b11e4c7c519625834bd32e30ad2cbcd1638632d
Instruction Fuzzy Hash: 78517E63F1465284FB40AFA5D8892ADAB72AF85BB4F900635DE1C17BDADF6CD440C320

Function 00007FF7C99B3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF7C99B309D), ref: 00007FF7C99B36CE
CreateDirectoryW.KERNEL32 ref: 00007FF7C99B3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7C99B309D), ref: 00007FF7C99B3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B37CE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 5107454ce0e231fdecdaae60bb7ef4984c9dc1d68db2d5f938fb65afab108feb
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: A931A462A1D68281EBB0EF259486279E771BFC97B0FD00231EE9D42A95DF3CD4458620

Function 00007FF7C99D2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7C99D2D7B

Part of subcall function 00007FF7C99D27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7C99D281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C99D2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C99D2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7C99D2E51

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: eb1d1cc812eec9a6d704baaaf5b3ff9e4f6208c13c1570d1ccb918cbd7e9c1c5
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: A9311B12A0C28342FBD4BF6595993BDAAB1AFD1364FC41474D90E4B6D7DE2DA8048272

Function 00007FF7C99B2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF7C99B2927,?,00100000,?,00000001,00000000,00000000,?,00007FF7C99B14C1), ref: 00007FF7C99B2348
ReadFile.KERNELBASE ref: 00007FF7C99B2367
GetLastError.KERNEL32 ref: 00007FF7C99B239B
GetLastError.KERNEL32 ref: 00007FF7C99B23BA

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 00888395990e924ad60066271c03bd8618983078dd12555d5822e74cf4f07d84
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 43217F21A0C68281EBB0BF51A40427DEBB0FBE5FB4F944530DE5D4A688CE7DD8858732

Function 00007FF7C99BE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99BECD8: ResetEvent.KERNEL32 ref: 00007FF7C99BECF1
Part of subcall function 00007FF7C99BECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF7C99BED07

ReleaseSemaphore.KERNEL32 ref: 00007FF7C99BE974
CloseHandle.KERNELBASE ref: 00007FF7C99BE993
DeleteCriticalSection.KERNEL32 ref: 00007FF7C99BE9AA
CloseHandle.KERNEL32 ref: 00007FF7C99BE9B7

Part of subcall function 00007FF7C99BEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C99BE95F,?,?,?,00007FF7C99B463A,?,?,?), ref: 00007FF7C99BEA63
Part of subcall function 00007FF7C99BEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C99BE95F,?,?,?,00007FF7C99B463A,?,?,?), ref: 00007FF7C99BEA6E

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 491cae08556413900ffa4959652a249bea3b523e71a99f44b4b4de698eb30422
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: F6012D32A18A8192E798EF61E5442ADB730FBC4BE1F404071DB5E13665CF39E4B48790

Function 00007FF7C99BEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF7C99BEAE0
SetThreadPriority.KERNEL32 ref: 00007FF7C99BEB36

Strings

CreateThread failed, xrefs: 00007FF7C99BEAEE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 5e98e26622cbfe88d609a8694cd6fd9c75150843050da58d09c008d2cd1e4579
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 0E11BF31A08A4281E7A0EF11E8512ADFB74FBC07A4FC84135DA8E03628DF3CE581C760

Function 00007FF7C99C946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7C99BDDDF

OleInitialize.OLE32 ref: 00007FF7C99C9486
SHGetMalloc.SHELL32 ref: 00007FF7C99C94D4

Strings

riched20.dll, xrefs: 00007FF7C99C9475

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 18cc4e901b5aac7a7bc63b17250e2d75893ed68cbe981cd12b189030d8aea1ad
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: EEF04F71618A8182EB90AF20F45466EFBB0FB88764F801135E98E42B64DF7CD559CB10

Function 00007FF7C99C095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99C853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7C99C856C

Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB67
Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB80

Part of subcall function 00007FF7C99A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1FFB

Part of subcall function 00007FF7C99A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99D01C1
SendDlgItemMessageW.USER32 ref: 00007FF7C99D01F2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction ID: 06a30e5f08c3a15aece4fb7c8052c25be426180155ec37bb529709ad299e27a0
Opcode Fuzzy Hash: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction Fuzzy Hash: 1251CF62F056429AEB50AFA1D8452FDA772EBC5BE8F800135DE4D177D6DE2CE540C360

Function 00007FF7C99A1744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A18A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7C99A18D4

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 0aea9c3c87e16ca9382b17eaa19c0ac0a5c93a98bd21b50b4506c2c51cf5c440
Instruction ID: 23b47f841a55b580239ed68590229fa871b22618099f8536da7356d187a0c851
Opcode Fuzzy Hash: 0aea9c3c87e16ca9382b17eaa19c0ac0a5c93a98bd21b50b4506c2c51cf5c440
Instruction Fuzzy Hash: E841FE62B0868581EB64AF12E644279E775EB84BF0F844231DEAC07BE5EF3CE1918314

Function 00007FF7C99B2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7C99B21CF
CreateFileW.KERNEL32 ref: 00007FF7C99B223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B22D8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: b78cd211d94593f0e1defc4703b1ab60a5c561013f2fe83368dcc6d8e3b31c85
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: 6641D062A0878582EBA4AF15E44426DABB0FBD5BB4F904334DFAD03AD5CF3CE4908611

Function 00007FF7C99A23F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7C99A243E
GetWindowTextW.USER32 ref: 00007FF7C99A2476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A2505

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: b7e0b5e1dd5e969e45baf8e9f33dc84fb1e560deaaf64bb90f4cdb929c23ba53
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: 1D218F63A18B8181EA54AF65A84416EB774FBC9BE0F545235EBDD03B95DF3CD180C740

Function 00007FF7C99C1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99C205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99C2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99C2093

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: ed06525d720d284fc54222632f53f2fcbb29030dbea5caf8b24800418b5d5b0f
Instruction ID: fba5169d23695e67c25ecee0de7b0ec056afb2cf1966c0da806a9b482fee64f3
Opcode Fuzzy Hash: ed06525d720d284fc54222632f53f2fcbb29030dbea5caf8b24800418b5d5b0f
Instruction Fuzzy Hash: 18316323A0968651FBA4FF14E8443BDE7B0FB80B94F944432D68C066A5DF6CE656C712

Function 00007FF7C99B3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF7C99C07E1), ref: 00007FF7C99B3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF7C99B3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B3E1A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: 605052bc6ff23df3386fa5af192a41ebe3b1c4039aa0d556dc37ae2ea214ef09
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: D021C823A18A8182EB60EF25E44526DB771FFC8BA4F905230EE9D46A95EF3CD540C610

Function 00007FF7C99B31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF7C99C0822), ref: 00007FF7C99B31E7
DeleteFileW.KERNEL32 ref: 00007FF7C99B3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B32A1

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: 15f53499debc05907ecf3b7ac4d94eb5ba91d8a48c05967cc028a8961c1d1592
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: DA21A422A1878181EBA0EF25E44526EB770FFC5BE4F901230EE9D42A99DF2CD540C620

Function 00007FF7C99B32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF7C99BE5B1,?,?,?,00000000,?), ref: 00007FF7C99B32E7
GetFileAttributesW.KERNELBASE ref: 00007FF7C99B3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B3399

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: 7dc69e7fa7f958ded6c16d70745b76fafe49ea204373aa0ddacf09ed16cee43a
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: 3D216522A1868181EB60EF19E44512EA771FBC9BB4F900231EA9D43AD5DF3CD540C610

Function 00007FF7C99DBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7C99DBF48), ref: 00007FF7C99DBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF7C99DBF48), ref: 00007FF7C99DBF97
ExitProcess.KERNEL32 ref: 00007FF7C99DBFA6

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 11d21b035edda2282b351e6e358468fe234b3915f3b75eacd284b9b5e11df779
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 81E04F25F0830546EBD47FB698D9379AB72AFC9762F50547CD80E03396CE3DA8498720

Function 00007FF7C99AF578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AF89B

Part of subcall function 00007FF7C99B3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7C99C0811), ref: 00007FF7C99B3EFD

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 23f630cba899342486ec3d5de318505faaaca4e13abb6a95497164dac5ca7356
Instruction ID: 8ff362e507590cacc8a9b0d533834776647fa6cd390b4b886f5d964fc82d0709
Opcode Fuzzy Hash: 23f630cba899342486ec3d5de318505faaaca4e13abb6a95497164dac5ca7356
Instruction Fuzzy Hash: 0D91B073A18A8194FB50EF24D4842ADAB71FBC47A8FD04135EA8E07AE9DF78D555C320

Function 00007FF7C99A3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A3AB9

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction ID: cb048562c68ecb4ffab409ad67d414230bcbc17819311af8ad20fd547c8ba38f
Opcode Fuzzy Hash: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction Fuzzy Hash: E641B062F1465284FB40EFB1D4452ADAB30EFC4BE8F945235EE5D27E9ADE3894828210

Function 00007FF7C99B2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF7C99B274D), ref: 00007FF7C99B28A9
GetLastError.KERNEL32(?,00007FF7C99B274D), ref: 00007FF7C99B28B8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: fb158022a9b073234a257b279e604af9bebff38d72f8511bed709862cd7f7435
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: EF31C622B1998281FBB06F26D54067DAB70EF94BF4F940131DE1D577A4DE2CD4418261

Function 00007FF7C99A22BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7C99A22F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A23F0

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: f17ea5f402f39fb32b2114ea274f4ab1e97c32249136060e8c3903da8987de67
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: 4931B022A1878182EB94AF15E54536EF770EBC5BA0F904231EB9C07B95DF3CE1408720

Function 00007FF7C99B2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF7C99B2AFE
SetFileTime.KERNELBASE ref: 00007FF7C99B2B9B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 1ed0459fd787c96fc78eaf2ad4e6d94ed7c1a43815bbc10c98ef4a7f34c9232f
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: ED21E722E0D7A651EBB1AF51D4203BEDFB0EF927A4F984031DE4C02295EE3CD446C211

Function 00007FF7C99BAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7C99BAB67
LoadStringW.USER32 ref: 00007FF7C99BAB80

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 8e625fd8862b952f7df11c5dd2700f0cce0c5615dd15fc5f42476c088d263286
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 84118E71B0961185EBD0AF26A88456CFBB1BB98FE0F944439CE1E93720DE7CE541C354

Function 00007FF7C99B2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF7C99B2C11
GetLastError.KERNEL32 ref: 00007FF7C99B2C1E

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 3647c5361b7cd7574a0b2756bc8ddbec827bdcde88a48e7b1f004060738987f0
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 25119021A0868181EBA0AF25E84127DAA70EB95BB4F940771DA7D162D5CF3DD582C311

Function 00007FF7C99A255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99BA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99BA504
Part of subcall function 00007FF7C99BA4AC: SetDlgItemTextW.USER32 ref: 00007FF7C99BA573
Part of subcall function 00007FF7C99BA4AC: GetWindowRect.USER32 ref: 00007FF7C99BA5AD
Part of subcall function 00007FF7C99BA4AC: GetClientRect.USER32 ref: 00007FF7C99BA5BB

GetDlgItem.USER32 ref: 00007FF7C99A25AC
SetWindowTextW.USER32 ref: 00007FF7C99A25C8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 63fcd59cfdc7e3ea75712c58ce26485e4fc4556a6c3fe5cc685601725d9e7c7d
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 19010410A1938A41FFD9BF92A45477DEBB1EFC5764F846035D84D06295DE6CE484C321

Function 00007FF7C99BEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7C99BEBAD,?,?,?,?,00007FF7C99B5752,?,?,?,00007FF7C99B56DE), ref: 00007FF7C99BEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF7C99BEB6F

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 1dcf94adc90e6827d9d7c13c44a6c23b9f982716dbe02c0ec05a93d30ef70439
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 50E02B61F1854642DF989F97C4504E9B7B2BFC8B50BC48035D60B83614DE2CE5458B00

Function 00007FF7C99D21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99D2200

Part of subcall function 00007FF7C99D2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99D2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99D2206

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: 99904191b68472eae26bed493fdb60c8c0441428fe417b16164e5e2b75e39a79
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: 08E0EC42E0A18745FFE83E7619AE1B988704FDA770EDC5B30DA7E092C2AD1CB5958231

Function 00007FF7C99DD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF7C99DD922
GetLastError.KERNEL32 ref: 00007FF7C99DD934

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: ead4479224ea0468894104995456b45af425d87472b26ae0579627df891e38a0
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 18E0E662E0D50386FF94BFF258891B8AAF15FD4771B845434C90D97662EE3C94858624

Function 00007FF7C99A33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A388C

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction ID: 561b40ec60101adfe3ef5fa8edda6af097cfc0d4b9f66d49a712af71da793f6e
Opcode Fuzzy Hash: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction Fuzzy Hash: 10D1CB62B0868155EBA8AF2595452BCFFB5FB85BA4F844075CB9D07BA5CF38E4608320

Function 00007FF7C99B5294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B551B

Part of subcall function 00007FF7C99C13F4: CompareStringW.KERNEL32 ref: 00007FF7C99C145A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction ID: fcef790fddb3d1950844464f04d4e677fc5921ae477784131491c4dc54e37856
Opcode Fuzzy Hash: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction Fuzzy Hash: 0E61D512A0C64781FBF4BE15491427EEAB2AFC9BF4F944131DE4D06BC5EE6CE8418232

Function 00007FF7C99C1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99BE948: ReleaseSemaphore.KERNEL32 ref: 00007FF7C99BE974
Part of subcall function 00007FF7C99BE948: CloseHandle.KERNELBASE ref: 00007FF7C99BE993
Part of subcall function 00007FF7C99BE948: DeleteCriticalSection.KERNEL32 ref: 00007FF7C99BE9AA
Part of subcall function 00007FF7C99BE948: CloseHandle.KERNEL32 ref: 00007FF7C99BE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C1ACB

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: c9fb0bd089dfeb63d9e2bdc9fa924defd0287578730a09343b72146483e13d02
Instruction ID: 35e1c903e6a8bbe2a7dc0ea4bba34679e4ec60cb796368805c80f9ecb360a105
Opcode Fuzzy Hash: c9fb0bd089dfeb63d9e2bdc9fa924defd0287578730a09343b72146483e13d02
Instruction Fuzzy Hash: C161AE72B16A8592EF58EF65D6940BCB774FF80FA0B944132EB2D07AC1CF28E5608314

Function 00007FF7C99AEC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AEEB8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 69a943e656ee331f1661201cfe822fb8f69a168c4299475660200162fa714270
Instruction ID: f77fa5e57e8d4ca6558110efeeead2528481dbf2b3680a88737094c528048569
Opcode Fuzzy Hash: 69a943e656ee331f1661201cfe822fb8f69a168c4299475660200162fa714270
Instruction Fuzzy Hash: 5151D462A0868241FB90AF6594453ADBF71FBD5BE4F940136EE9D07792CE3DE485C320

Function 00007FF7C99AE7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7C99C0811), ref: 00007FF7C99B3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AE993

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: 6db2445bd760f30021820f05dffa892774c8154099c5fed81b4f7f11b0e693f3
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: 1F514122A0878681FBA0AF69E44536DBB71FFC5BE4F940136EA8D076A5DF2CD441C720

Function 00007FF7C99B1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B187D

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 27319caa984fd9bf2efda9575f3c4a4ff381f3c9e17273c3b2946047ae8ede0a
Instruction ID: daa08f8d8f9c4e9009c9661abcd530a898919bd9114f2f7f99b7285dc60133fe
Opcode Fuzzy Hash: 27319caa984fd9bf2efda9575f3c4a4ff381f3c9e17273c3b2946047ae8ede0a
Instruction Fuzzy Hash: 6041D662B18A8142EB64AE17A644379EA71FBC4FD0F888535EE4C47F5ADF3CD5918300

Function 00007FF7C99B2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B30C8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction ID: 2819cd4889168e838f39d5c2a5967c19b1b7843c97c683518c417d8230074bd5
Opcode Fuzzy Hash: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction Fuzzy Hash: 9441E462A09B4580EBA4AF25E14637DAB71EFD5BE8F941135EE4D07B99DE3CE4408220

Function 00007FF7C99DBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C99DBE20

Part of subcall function 00007FF7C99DBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF7C99DBFD0
Part of subcall function 00007FF7C99DBFB0: GetProcAddress.KERNEL32 ref: 00007FF7C99DBFE6
Part of subcall function 00007FF7C99DBFB0: FreeLibrary.KERNEL32 ref: 00007FF7C99DC00B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 1e8cae4f6c63458e91ce41f25e4508ab4e4490bcde4eefd30f2217bdaa9deead
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 8F41C323E1860282FBD4BF259894138AE71AFE5BA0FC45476DA0E07691DF3DE840C7B0

Function 00007FF7C99A129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A1396

Part of subcall function 00007FF7C99A1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99A1F89

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction ID: 728d3fdf99e75e345d03b30716317a215dbabb2d614eb0accb2af8ac72f95816
Opcode Fuzzy Hash: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction Fuzzy Hash: 59219522A0875185EB64AF52A440279AA70FB84BF0F980731DFBD47BD1DE7CE1518364

Function 00007FF7C99E124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99E1280

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: b3998a4ffd497344a9424377547613b684680a4fb9c810ae14c3021ce8f62cf6
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 07114C3291C64286F7A0AF60A880639FAB4FFC43A4FD50135E68E87796DF2CE550C764

Function 00007FF7C99A3AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A3B6C

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: 9f54b80c212de2d56958148b7e11d54519cf90be5872b502e56a4fbb9b6a1815
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: 8601A162E1868541EB91AF28E44622DB772FFC9BB0FC05231E6EC07AA5DF2CD0408614

Function 00007FF7C99D1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7C99D1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF7C99D1573,?,?,?,00007FF7C99D192A), ref: 00007FF7C99D162B

DloadProtectSection.DELAYIMP ref: 00007FF7C99D15C9

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: da98d025baffd4a0f9cd9929a7d7b0775caa7bcb1202cd26d8e092ed2fb6a5ac
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: B411F162D4890741FBE8BF19A484774BB70AF94768FC420B4D50E472A1EE2DB595C624

Function 00007FF7C99B3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B40BC: FindFirstFileW.KERNELBASE ref: 00007FF7C99B410B
Part of subcall function 00007FF7C99B40BC: FindFirstFileW.KERNELBASE ref: 00007FF7C99B415E
Part of subcall function 00007FF7C99B40BC: GetLastError.KERNEL32 ref: 00007FF7C99B41AF

FindClose.KERNELBASE(?,?,00000000,00007FF7C99C0811), ref: 00007FF7C99B3EFD

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: f2922b85152e8ea43d7883ea84fbb69e10ba4256c9be7a49c24f12ae8d6e6d49
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 3EF0A46250D24285EBA0BFB5A501279BB709B95BB4F941334EE3D077C7CE2CD4448764

Function 00007FF7C99B273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF7C99B2755

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: 0d07cf52dc728be0cdd7553cb0728a2c1f135c1d91c00e2ac3d4876b069dabb8
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: CAE08C12A2495582EBA0BF6BC882668A770EFC8B95B8810B0CE0C07331CE2CD8818A14

Function 00007FF7C99B2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7C99B24A2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: bca449b9a3095132429b3d7e3f3f51256d49cfcbe88a26565f1aca0019405a8b
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 20D01212D0948182DFA0BF76989107C7761EFE7735FE40770DA3E91AE1CE1D9496A322

Function 00007FF7C99B7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF7C99B7FD2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: b047dc4b813157f27ec0f3757c9fca3f2ffa9f9dd8da9588bcfdb68a4f9e60e8
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 63C08C20F09502C1DB08AF26C8C902823B4BB80F15BA04034C60C81120CE2CC9EA9359

Function 00007FF7C99DFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7C99DFA59

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: aa4e1f7b3c4c203cce3791a7c4647695d94eba1cc4dcdf5bd3e7c8ab81e8888e
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 99F06256B2960745FFD47EA5999A3B49AB05FD4BA0FCC5430C90F4A3C1FE1CE5914130

Function 00007FF7C99DD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7C99DD98A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 3e483ae55dcff17b2823d93cbd39a6eecc632392f97aec029f9fa19604403c6d
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 67F05E12B0A20745FFD47EB158882B49EB05FC47B1FC82630D96E46BD1DE1DA4408130

Function 00007FF7C99B20D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF7C99B207E), ref: 00007FF7C99B20F6

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: f75b396a5b231016b500f637773c7e1c11f53c538ee4c3dcd389295f2587a5be
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: B1F08C22A0868285FFB49F20E44127DBA71EBA4BB8F885334DB3D011D4CE2CD8D5C321

Non-executed Functions

Function 00007FF7C99AC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99ADE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C99ACF4B), ref: 00007FF7C99ADE27
Part of subcall function 00007FF7C99ADE04: GetLastError.KERNEL32 ref: 00007FF7C99ADE88
Part of subcall function 00007FF7C99ADE04: CloseHandle.KERNEL32 ref: 00007FF7C99ADE9B

wcscpy.LIBCMT ref: 00007FF7C99ACBC8
wcscpy.LIBCMT ref: 00007FF7C99ACBFE
CreateFileW.KERNEL32 ref: 00007FF7C99ACC38
DeviceIoControl.KERNEL32 ref: 00007FF7C99ACD01
CloseHandle.KERNEL32 ref: 00007FF7C99ACD12
GetLastError.KERNEL32 ref: 00007FF7C99ACD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF7C99ACD7D
DeleteFileW.KERNEL32 ref: 00007FF7C99ACD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99ACED7

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF7C99AC34F
SeRestorePrivilege, xrefs: 00007FF7C99AC343
\??\, xrefs: 00007FF7C99AC392, 00007FF7C99AC3B8
UNC\, xrefs: 00007FF7C99AC53F, 00007FF7C99AC55D

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 2109ac67ef454bbe604bd7410721986f8a24db34ebf8dc3af2521a2cef9c7c6b
Instruction ID: 9cb26878ad2e61f116622109c6de8dc99f965d35f9e8e6dc292d1ed39f920399
Opcode Fuzzy Hash: 2109ac67ef454bbe604bd7410721986f8a24db34ebf8dc3af2521a2cef9c7c6b
Instruction Fuzzy Hash: 7462BF62F0864285FB80EF74D4842ADAB71EBC5BB4F904231DAAD57AD5EE38E585C310

Function 00007FF7C99BF180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7C99C0528

Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB67
Part of subcall function 00007FF7C99BAAE0: LoadStringW.USER32 ref: 00007FF7C99BAB80

Part of subcall function 00007FF7C99CB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7C99C0429), ref: 00007FF7C99CB110
Part of subcall function 00007FF7C99CB0DC: SetLastError.KERNEL32 ref: 00007FF7C99CB153

Part of subcall function 00007FF7C99A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C0538

Strings

%s: %s, xrefs: 00007FF7C99BFC11
%ls, xrefs: 00007FF7C99BF3AC, 00007FF7C99BF3FF

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: e89bfa93e3b546c3379b1ef1a344197b4ed21777381125368a70589fb59b603c
Instruction ID: 78c5b67a29479ad79b67f78daea801bce49cfb98ca11f7b5311d1d6db8274422
Opcode Fuzzy Hash: e89bfa93e3b546c3379b1ef1a344197b4ed21777381125368a70589fb59b603c
Instruction Fuzzy Hash: 40B29C63A1968291EB60BF65D8541BEE771EFC97E0F904236EADD036D6EE2CD140C720

Function 00007FF7C99E2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99E2C12
memcpy_s.LIBCMT ref: 00007FF7C99E35BF
memcpy_s.LIBCMT ref: 00007FF7C99E3666

Part of subcall function 00007FF7C99E38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99E38EE

memcpy_s.LIBCMT ref: 00007FF7C99E372F

Part of subcall function 00007FF7C99DD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DD02D

Strings

1#SNAN, xrefs: 00007FF7C99E37C9
1#INF, xrefs: 00007FF7C99E3807
1#IND, xrefs: 00007FF7C99E37AA
1#QNAN, xrefs: 00007FF7C99E37E8

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 4e50434c415f85e13bfb912e6c3c34ce53d0c4c7aee66cfed5063a220ac7023c
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 8BB20472A0C2C28BE7A5AE29D4416FDBBB1FBC4798F905135DA0A57F84DF38E5048B10

Function 00007FF7C99B1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF7C99B1A97
GetLongPathNameW.KERNEL32 ref: 00007FF7C99B1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF7C99B1B21
GetShortPathNameW.KERNEL32 ref: 00007FF7C99B1B6A

Part of subcall function 00007FF7C99C13C4: CompareStringW.KERNEL32 ref: 00007FF7C99C13E3

MoveFileW.KERNEL32 ref: 00007FF7C99B1DFE
MoveFileW.KERNEL32 ref: 00007FF7C99B1E65

Part of subcall function 00007FF7C99B2134: CreateFileW.KERNEL32 ref: 00007FF7C99B223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B1FED

Strings

rtmp, xrefs: 00007FF7C99B1CF4, 00007FF7C99B1D03

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 6f9f009cc68f79adfaa2d6c81f4dd6478a908af634b8d3a3b94ef6884c4367c6
Instruction ID: b153597b9b98f4fbc5a4f7aa0369519a7796aad8a6b62472ce96a257a18f6607
Opcode Fuzzy Hash: 6f9f009cc68f79adfaa2d6c81f4dd6478a908af634b8d3a3b94ef6884c4367c6
Instruction Fuzzy Hash: 4EF1D522B08A8285EB60EF65D4801FDAB71EBD57E4F901131EE4D43AA9DF3CE684C750

Function 00007FF7C99B5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7C99B5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF7C99B5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF7C99B5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF7C99B5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B5EF2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: 9e678f371d370c9f84ebcb46113a4ab003708923ae3bf605c6f167c79bc40da5
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: DEA1A262F14B5184FF60AFB9D8481BCA732ABC5BB4B944235DE6D17BD8DE3CE0818211

Function 00007FF7C99D3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7C99D318C
RtlCaptureContext.KERNEL32 ref: 00007FF7C99D31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C99D31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C99D3214
IsDebuggerPresent.KERNEL32 ref: 00007FF7C99D3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C99D3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C99D3294

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 062afdc25ae2eb4cbf892724c1dd530b8e0527c31d023f18745be472bf3dc33a
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 41317272609B818AEBA0AF61E8943EDB770FB84758F844439DB4D47B88DF38D548C720

Function 00007FF7C99D76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7C99D7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C99D7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C99D77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF7C99D77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C99D77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C99D77F2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 5066bf3f65deafbdfae1b15602bf4dea160fa275b5c0705869f4490a281eb29a
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: DE316232608B8185E7A09F65E8842AEB7B4FBC4B64F940135EA9D43B99DF38D545C710

Function 00007FF7C99A1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99A1EBB

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 64d25151ef3fe23f20685aee3441bda27b372bcb0863407ca166e54c625fc733
Instruction ID: da6675887399059b6fe6ea6bb045b5de6365d64ce0672e159db01b86e56828c1
Opcode Fuzzy Hash: 64d25151ef3fe23f20685aee3441bda27b372bcb0863407ca166e54c625fc733
Instruction Fuzzy Hash: 5AB1C062B1468686EB60AF65D8442EDA771FFC57E4F905231EA8D07B99EF3CE640C310

Function 00007FF7C99DFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DFAC4

Part of subcall function 00007FF7C99D7934: GetCurrentProcess.KERNEL32(00007FF7C99E0CCD), ref: 00007FF7C99D7961

Strings

., xrefs: 00007FF7C99DFEE4
*?, xrefs: 00007FF7C99DFAEB

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: f703df37a4a340d08c1464272f6a557e3b2de627f37156f1a214393865eb5987
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 3151F663B25B9541FF50EFA198950B8ABB4FB88BE8B844531DE1E17B84EF3CD0528310

Function 00007FF7C99E2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7C99E210B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 98af2cd675a356e5fd426929701c46299e7cdc7f906151a64be412260284cae8
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 6DD1C032B1C6C687DBA4DF15E1846AEBBA1FBC87A4F548134CB4E57B44DA3CE8418B10

Function 00007FF7C99AB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF7C99ABA9D), ref: 00007FF7C99AB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF7C99ABA9D), ref: 00007FF7C99AB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF7C99ABA9D), ref: 00007FF7C99AB743

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: be7ee5e4bc9ea5769d2ae074683d21e92ca344c0cc7dc3385fbad35323f414c0
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 15014F7260C74282E790AF62B89017EA7A5FBCABD1F884034EA8D47B45CE3CD9158710

Function 00007FF7C99DFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7C99DFEE4

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: e0fa670d7f70206be132987e2b9b012cb60ae431fa4be43b534ba5ee9cce0314
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 96311823B1869145E7A0AF3298497A9BEA1ABD4BF4F848234DE6D07BC5CE3CD5118310

Function 00007FF7C99E5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7C99E5D45
RaiseException.KERNEL32 ref: 00007FF7C99E5D56

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 453c4452a7e284438f85351a6c478faafed02904653199d914b1f1285fb9928e
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 9CB19D73A18B888BEB55CF29C84636C7BB0F784B58F198921DB5D837A8CB39D451C711

Function 00007FF7C99C8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99C85E0: GetDC.USER32 ref: 00007FF7C99C85EC
Part of subcall function 00007FF7C99C85E0: GetDeviceCaps.GDI32 ref: 00007FF7C99C85FD
Part of subcall function 00007FF7C99C85E0: ReleaseDC.USER32 ref: 00007FF7C99C860A

GetObjectW.GDI32 ref: 00007FF7C99C8E48

Part of subcall function 00007FF7C99C90B0: GetDC.USER32 ref: 00007FF7C99C90D9
Part of subcall function 00007FF7C99C90B0: GetObjectW.GDI32 ref: 00007FF7C99C9107
Part of subcall function 00007FF7C99C90B0: ReleaseDC.USER32 ref: 00007FF7C99C91BB

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 4b70170d0c87d4941a8bd6f066bfce6c52c9d57c9753206368a81ced765b652e
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: F0815E32B08A0586EB50EF6AD8406ACBB71FB88B98F4041B2DE0D57B64DF3CD545C750

Function 00007FF7C99CA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF7C99CA315
GetNumberFormatW.KERNEL32 ref: 00007FF7C99CA371

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 4579bf204d67076a206a7c3f39597d0620ecbbfc595bbf6b7fae860e15be4ff7
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 3F118C62A08B8196E7A1AF21E8107E9BB70FF88BA4FC44031DA4D03A64EF3CD145CB54

Function 00007FF7C99B126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B24C0: CreateFileW.KERNELBASE ref: 00007FF7C99B259B
Part of subcall function 00007FF7C99B24C0: GetLastError.KERNEL32 ref: 00007FF7C99B25AE
Part of subcall function 00007FF7C99B24C0: CreateFileW.KERNEL32 ref: 00007FF7C99B260E
Part of subcall function 00007FF7C99B24C0: GetLastError.KERNEL32 ref: 00007FF7C99B2617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B15D0

Part of subcall function 00007FF7C99B3980: MoveFileW.KERNEL32 ref: 00007FF7C99B39BD
Part of subcall function 00007FF7C99B3980: MoveFileW.KERNEL32 ref: 00007FF7C99B3A34

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction ID: 2369fa1b641945e0d017b7074ea9cf7e9124f2fc0e432a67699ca68aced2315b
Opcode Fuzzy Hash: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction Fuzzy Hash: BA91C122B18A4682EBB0EF62D4442ADAB71FBD5BD4F804036EE4D47B95DE3CD645C320

Function 00007FF7C99B4EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7C99B4EE2

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: def3b109a3d7bc34af00062eb0f1b1b8e7392950b7960f5b977b2e64e76af9a2
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: 99015A7194D58285FBF1AF21A8143B9FBA09BE9765FC41134CA9D07291CE2CA048DA24

Function 00007FF7C99D8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7C99D8DD3

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 25fb65ae3a170fd360d53580ac6fa36cc2367633c8e1264e5b33b24317883daf
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: C4810623A1814247EBE8BE2680C867DAAB0EFE0B64F941471DD09976D7CF2DE801C760

Function 00007FF7C99D89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7C99D8B3A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 78bba30db4b001872604644f1ab3a256a4feeb3d30458f69d773c74983113201
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 9D711863A0C24346FBE4AE1B40C827DEFB09FC1764F9819B1DD0997697CE2DE8468761

Function 00007FF7C99BC96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF7C99BC97B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: fec0b8fc95b448aeaeabe6126eb3d62dad300ad0cfaa37488d697d3ece957296
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 8251AF376286908BD764CF25E404A9EB7B5F388798F445126EF8A93B08DB3DE945CF40

Function 00007FF7C99DC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF7C99DC874

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: bb6cb279adc095519dc832f08e799dc6fa46f2a6eff0c307e6bb6f4d960cf40c
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 0941C233714A4486EF84DF2AD5582A9BBA1B799FE0B9D9036DE1D87754EE3CD042C340

Function 00007FF7C99E0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7C99E0D24

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 74601cd1ceac214635753c5abb35cb30f25575cacdddb747e8d90dc3e55a65ac
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: FCB09230E1BA02C2EA893F626C8225876B4BFC8720FD4A078C10D42320DE2C20A58721

Function 00007FF7C99C3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction ID: a2026ffb9775ba9e04de01089480897cdf9fd8e224414415ca03b1e5f828a656
Opcode Fuzzy Hash: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction Fuzzy Hash: E58236B3A096C186D784DF24C8042BCBFB1F795B98F998136DA4E07785DA3DD445CB20

Function 00007FF7C99A76C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 9fea3ae70affdb18115528da5edcda1118708b9528d05bb7106e795474630e43
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: C3626D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF7C99C53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction ID: cdfd69a8eadea1b6a548aecd171b3d18766acb3af96227a656b0296dc652107a
Opcode Fuzzy Hash: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction Fuzzy Hash: 9482E1B3A0D6C18AD794DE24D8446FCBFB1E795B98F488136CA4D4778ACA3CD485CB21

Function 00007FF7C99BBB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 5c7ce380f758ce4c72d27d411ff0103aea61b183b4f31aa66422827ba49c9562
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 9322E4B3B246508BD728CF25C89AE5E3766F799744B4B8228DF0ACB785DB38D505CB40

Function 00007FF7C99C4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 2487e2660b66021c0a14e7e9fb6640b4e1f2b7abd925a213f22b2e21f02066a3
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 4532E272B081918BE75CDF24D954ABC7BB1F794B58F418139DA4A87B88DB3CE860CB50

Function 00007FF7C99A7288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 7d6a5c033bf84d24250dc2d1ab363941c38306f0b7941449e6f5d1b236cdf724
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: D5C19CB7B281908FE350CFBAE400A9D7BB1F39878CB519125DF59A3B09D639E645CB40

Function 00007FF7C99C2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: e35d228e7930f8312a017e44cbc71c4eef17e24b8e312a127c3000312e26d356
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 34A14773A0818646EBA5EE24D8047FDAFA1EBE0764F994135DE4D07786CE3CE841CB21

Function 00007FF7C99BAF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 32157256f41e5b24a045acd180cb3e87232020f03a1df4128156eac73487c874
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: 64C1F473A291E04DE302CFB5A4248FD3FB1E75E34DB8A4152EFA666B4AD52C5201DB70

Function 00007FF7C99AA310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: f03ecf10e39cb45628a6535c8f2222e5bbaae77c1a11ab1e41493ec042b01571
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: D6913063B1858196EB51EF29D8516FDAB31FF95798F841031EF4E07A49EE38E606C320

Function 00007FF7C99BB534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 6ac4b09c1380318569d9e45db5615d967701fe59036f1141259ec0e1741736a7
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: EF614923B081D189EB61DF7585408FDBFB1E79A7A4BC54032CF9A53A86DA3CE505CB20

Function 00007FF7C99C21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 6de7437cb5f32f9319ed3b5fe10102bc59852d0d513b6bd0ee42bc401a913c87
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 99511473B181914BE7A89F28D8087BDBB61FB94B68F844134DB4947A89DE3DE541CB20

Function 00007FF7C99C2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 74a3e3d09a52574cbca2fd223f019d826ea38bee59fece133f397771988d6055
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 123119B2A086814BD758EE1ADA5027EFBE0F785350F488139DF4683B82DA7CE041CB20

Function 00007FF7C99BDC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: 74887edf4c8bf5ad241fd2798626e0f67e80b24458b2ca13507bf3b776094d23
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: 97F0F4E1F1C00741FBF82C28D81933998759B91330FE484B5D92FC62E5DAAFE8811129

Function 00007FF7C99D3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 4f21c5225ce4b50bf3ca49bf308615a923a89e0f1876ff4fc86c34c476c48977
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: A4A001A690C842D0E795AF51A9A5070AA34BB90325BD01071F00D414A4AE2CA8018230

Function 00007FF7C99AD7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD964

Strings

::$INDEX_ROOT, xrefs: 00007FF7C99AD854
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF7C99AD85F
::$INDEX_ALLOCATION, xrefs: 00007FF7C99AD83E
::$ATTRIBUTE_LIST, xrefs: 00007FF7C99AD7FC
::$OBJECT_ID, xrefs: 00007FF7C99AD880
::$BITMAP, xrefs: 00007FF7C99AD807
::$DATA, xrefs: 00007FF7C99AD812
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7C99AD875
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7C99AD86A
::$EA_INFORMATION, xrefs: 00007FF7C99AD828
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF7C99AD849
::$REPARSE_POINT, xrefs: 00007FF7C99AD88B
::$EA, xrefs: 00007FF7C99AD81D
::$FILE_NAME, xrefs: 00007FF7C99AD833

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction ID: e99dec728e55839dceeb00f49e82185870d451946e6e9713cab2646dcbd84405
Opcode Fuzzy Hash: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction Fuzzy Hash: E041E736B0AF0199EB40EF65E4843E977B5EB887A8F840176DA4C13B68EF38D155C360

Function 00007FF7C99D2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7C99D2A26
GetModuleHandleW.KERNEL32 ref: 00007FF7C99D2A33
GetModuleHandleW.KERNEL32 ref: 00007FF7C99D2A48
GetProcAddress.KERNEL32 ref: 00007FF7C99D2A60
GetProcAddress.KERNEL32 ref: 00007FF7C99D2A73
CreateEventW.KERNEL32 ref: 00007FF7C99D2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF7C99D2AEB
CloseHandle.KERNEL32 ref: 00007FF7C99D2AFD

Strings

kernel32.dll, xrefs: 00007FF7C99D2A41
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7C99D2A2C
SleepConditionVariableCS, xrefs: 00007FF7C99D2A56
WakeAllConditionVariable, xrefs: 00007FF7C99D2A66

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: 695c5c6e1acbcecf74a94ef3b83fec5848a2a6307332022329d84fa1c9ebbe84
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 1A210C61A0DA4381FBD5BF66E89957CBBB0EF857A0FC41075C90E026A1EE3CA485C231

Function 00007FF7C99B6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70A6

Part of subcall function 00007FF7C99A2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7C99A200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B70DC

Strings

\\?\, xrefs: 00007FF7C99B6A57, 00007FF7C99B6A66
DXGIDebug.dll, xrefs: 00007FF7C99B6A18
UNC, xrefs: 00007FF7C99B6BBF

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction ID: a16a81dcb38a13d26bab66e8801525ffe402e81ca58cb6a1f22fb4f767d89231
Opcode Fuzzy Hash: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction Fuzzy Hash: B512AE22B08A4284EF60EF65D4441ADAB71EBC1BA8F904236DF5D07AE9DF3DE545C360

Function 00007FF7C99CA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C99A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99CA747
EndDialog.USER32 ref: 00007FF7C99CA7BA

Strings

GETPASSWORD1, xrefs: 00007FF7C99CA773
Software\WinRAR SFX, xrefs: 00007FF7C99CA52B, 00007FF7C99CA53A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: e69a9d005af549575fd3de661828b91e519431c8b37e36aeb7afca3849238044
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: 33B1C362F1978285FB40AF64D8842BCA771ABC57A8F804235DE5C26AD9DE3CE145C324

Function 00007FF7C99C6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C99C7E9B), ref: 00007FF7C99C7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF7C99C70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C7187

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF7C99C6F2C, 00007FF7C99C6F3B
<html>, xrefs: 00007FF7C99C6F13
</html>, xrefs: 00007FF7C99C6F72, 00007FF7C99C6F81
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF7C99C6ED5, 00007FF7C99C6EE4

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction ID: ea64567e52268bbcc5e8a3d67ef6d48890a59dafaead4dd0b87ad117f874e9de
Opcode Fuzzy Hash: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction Fuzzy Hash: F281B063F18A4295FB40EFA5D8402EDBB71AF85BA8F800135DE1D1769ADF38D506C320

Function 00007FF7C99DE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DE7CD

Strings

NAN, xrefs: 00007FF7C99DE6B1
INF, xrefs: 00007FF7C99DE6C3
nan, xrefs: 00007FF7C99DE6B8
inf, xrefs: 00007FF7C99DE6D6
nan(snan), xrefs: 00007FF7C99DE6F0
NAN(SNAN), xrefs: 00007FF7C99DE6E5
nan(ind), xrefs: 00007FF7C99DE706
NAN(IND), xrefs: 00007FF7C99DE6FB

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: efbfe571c47725e2d2b7fe9575b4bba7f3625bb31c392cc91dd849bde160cd9c
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: D541BF72A09B4589E784DF65E8817AD7BB4EB583A8F814136EE9C03B54EE3CD025C354

Function 00007FF7C99CF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF7C99CF3CF
GetClassNameW.USER32 ref: 00007FF7C99CF3FC
GetWindowLongPtrW.USER32 ref: 00007FF7C99CF41D
SendMessageW.USER32 ref: 00007FF7C99CF437
GetObjectW.GDI32 ref: 00007FF7C99CF452
SendMessageW.USER32 ref: 00007FF7C99CF487
DeleteObject.GDI32 ref: 00007FF7C99CF490
GetWindow.USER32 ref: 00007FF7C99CF49E

Strings

STATIC, xrefs: 00007FF7C99CF402

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 2d2e2fe15c6242537053f45eee1a7e9c816e19c34b7da608ba4d956147bcbda6
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: FB31A421B0864242FBE0BF22A954BB9ABB1AFCDBE0F901430DD4E07B55DE3CD4058B60

Function 00007FF7C99CAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF7C99CAEAE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 733ccbe7946008d9f3ef0da71dbccb525334bcbdd0ac28a00436a834629ea930
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: 72417C21A0865282FBD4AF62AC54B7DEAB0ABC5FA0F945034D90E03B95CF3CE545C721

Function 00007FF7C99BB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7C99BBA12
GetProcAddress.KERNEL32 ref: 00007FF7C99BBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF7C99BBACA

Part of subcall function 00007FF7C99BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7C99BDDDF

Strings

CryptProtectMemory failed, xrefs: 00007FF7C99BBA80
Crypt32.dll, xrefs: 00007FF7C99BB9F0
CryptUnprotectMemory failed, xrefs: 00007FF7C99BBAC1
CryptProtectMemory, xrefs: 00007FF7C99BBA08
CryptUnprotectMemory, xrefs: 00007FF7C99BBA1F

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: 6ddd71a6cb8836fb52de330c5b44b1a3a643991a145d5f85f4ac8159e063c015
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: E2312B20E0DA0680EBE4BF56A854A79BFB0AF86BB0F845135DC4E037A4DE3CE541C320

Function 00007FF7C99C87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99C8DE0

Strings

, xrefs: 00007FF7C99C88BE
, xrefs: 00007FF7C99C8A55

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 21e62478960f4ce8d0e7242d7b9149d0a339b7dfd3a44c89ed8729fa7c19746b
Instruction ID: 6a412084dc52fb69769c0146e58e6598f0468f4fd24ea5962348805addf1ac7a
Opcode Fuzzy Hash: 21e62478960f4ce8d0e7242d7b9149d0a339b7dfd3a44c89ed8729fa7c19746b
Instruction Fuzzy Hash: A1F1D062F1464641EF50AF66D9881BCAB71AB84BB8F805631CB6D13BD5DF7CE180C360

Function 00007FF7C99D57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7C99D598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C99D5CAD
abort.LIBCMT ref: 00007FF7C99D5CE1

Strings

csm, xrefs: 00007FF7C99D5933
csm, xrefs: 00007FF7C99D58D1
csm, xrefs: 00007FF7C99D59B1

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: cd0364834781f35f765501cdc01e0c00ed2826fe261b7e7cf8f793d9da79f1e0
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 61E1B0739087828AE790AF34D4C83ADBBB0FB85768F940135DA8D4769ACF38E485C711

Function 00007FF7C99B4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B4E24: SysAllocString.OLEAUT32 ref: 00007FF7C99B4E5F

VariantClear.OLEAUT32 ref: 00007FF7C99B5125

Strings

ROOT\CIMV2, xrefs: 00007FF7C99B4F7B
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF7C99B5017
Windows 10, xrefs: 00007FF7C99B510A
Name, xrefs: 00007FF7C99B50F9
WQL, xrefs: 00007FF7C99B502A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 5cc880ba51fbf8e5792af093d18fea52dc672e03ba0d28ba5fda9fb603d4ff36
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: C7714F76A18B0585EB60EF66D8805ADBBB0FBC4BA8B845172DE4D43B64CF3CD544C350

Function 00007FF7C99D72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7C99D74F3,?,?,?,00007FF7C99D525E,?,?,?,00007FF7C99D5219), ref: 00007FF7C99D7371
GetLastError.KERNEL32(?,?,00000000,00007FF7C99D74F3,?,?,?,00007FF7C99D525E,?,?,?,00007FF7C99D5219), ref: 00007FF7C99D737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7C99D74F3,?,?,?,00007FF7C99D525E,?,?,?,00007FF7C99D5219), ref: 00007FF7C99D73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF7C99D74F3,?,?,?,00007FF7C99D525E,?,?,?,00007FF7C99D5219), ref: 00007FF7C99D73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7C99D74F3,?,?,?,00007FF7C99D525E,?,?,?,00007FF7C99D5219), ref: 00007FF7C99D73FB

Strings

api-ms-, xrefs: 00007FF7C99D7391

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: d66c85f54135b6cb5547b572c57e09dbc77221a3d5c443e6ffb5a57562aaba04
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 05319062A1E64281EF92BF46A844579EAA5FF88FB0F994535DD1D47380DF3CE4408730

Function 00007FF7C99D1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF7C99D1573,?,?,?,00007FF7C99D192A), ref: 00007FF7C99D162B
GetProcAddress.KERNEL32(?,?,?,00007FF7C99D1573,?,?,?,00007FF7C99D192A), ref: 00007FF7C99D1648
GetProcAddress.KERNEL32(?,?,?,00007FF7C99D1573,?,?,?,00007FF7C99D192A), ref: 00007FF7C99D1664

Strings

KERNEL32.DLL, xrefs: 00007FF7C99D1624
ReleaseSRWLockExclusive, xrefs: 00007FF7C99D1653
AcquireSRWLockExclusive, xrefs: 00007FF7C99D163E

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 306c5b723bea423c97a9aea5d2f79b9ab19a19609df4d2eae724012b3fc51f94
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: AE113023E0DB0381FFE9AF55A584174AAB16F897B4FCD5435C81D06394EE3CB5848630

Function 00007FF7C99BED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B51A4: GetVersionExW.KERNEL32 ref: 00007FF7C99B51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7C99A5AB4), ref: 00007FF7C99BEE05

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: d406c435be879d2978f3653146c5517a6086b6a3c43f714a218001785c32f906
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 7851BEB2B046518BEB54DFB9D4400ACBBB1FB88B98BA0403ADE0D67B58DF38E541C750

Function 00007FF7C99BF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF7C99BF074

Part of subcall function 00007FF7C99B51A4: GetVersionExW.KERNEL32 ref: 00007FF7C99B51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7C99BF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF7C99BF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF7C99BF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF7C99BF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF7C99BF0CE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: f052c1698330ee139110de9265150f534c1e73e1e69b4ce327ed350e6998ecb1
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: E3314A62B14A518DFB50DFB5D8801BC7770FF48768B94502AEE0EA7A58EF38D495C310

Function 00007FF7C99B7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B7C8C

Strings

sfx, xrefs: 00007FF7C99B79F3, 00007FF7C99B7A02
rar, xrefs: 00007FF7C99B7A9B, 00007FF7C99B7AAA, 00007FF7C99B7B67, 00007FF7C99B7B7C
.rar, xrefs: 00007FF7C99B7969, 00007FF7C99B7978
exe, xrefs: 00007FF7C99B79AF, 00007FF7C99B79BE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction ID: 26daaa52e0521ea4599df382184f0bd576d7eef155dae64988c4eeaa76c4ac1a
Opcode Fuzzy Hash: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction Fuzzy Hash: 3DA1AF22A18A0640EB90AF65D8952BCAB71BF84FB8F942235DD1D07BE5DF3CE541C360

Function 00007FF7C99D5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7C99D5D58

Part of subcall function 00007FF7C99D5210: abort.LIBCMT ref: 00007FF7C99D5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF7C99D5DA3
abort.LIBCMT ref: 00007FF7C99D5FD1

Strings

MOC, xrefs: 00007FF7C99D5D6C
RCC, xrefs: 00007FF7C99D5D74

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: ee6d73d36b7c164ea5f22c5aeb0975aa2957e9bd85e80655803143384b34adea
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: CA91C073A08B818AE790EF64E4843ADBBB0F784798F504129EE8C07B59DF38D195C710

Function 00007FF7C99D4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C99D4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7C99D5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF7C99D2F5E), ref: 00007FF7C99D508F

Strings

f, xrefs: 00007FF7C99D4FBE
csm, xrefs: 00007FF7C99D5026

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 2a38f36a4ecfc15d1e7449c0fd8116f4c6cd327ba64cdbf842728de37736138f
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 2651C733A1964286DB94EF15E488A39BB75FB81BA4F908034DA1E4774CDF78E881C751

Function 00007FF7C99ACEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C99AD03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD0D7

Part of subcall function 00007FF7C99ADE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C99ACF4B), ref: 00007FF7C99ADE27
Part of subcall function 00007FF7C99ADE04: GetLastError.KERNEL32 ref: 00007FF7C99ADE88
Part of subcall function 00007FF7C99ADE04: CloseHandle.KERNEL32 ref: 00007FF7C99ADE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF7C99ACF3F
SeRestorePrivilege, xrefs: 00007FF7C99ACF5E

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction ID: 440d9f9f6f6d02403f51941a8b2f6420625d674d3dc00d6c51f26e70b8c91d87
Opcode Fuzzy Hash: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction Fuzzy Hash: E651DB62E0865285FB90FF71D8406BDBBB0AFC57B4F801130DE9E136A6DE3CA485C220

Function 00007FF7C99C7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7C99C7B6F
GetWindowRect.USER32 ref: 00007FF7C99C7BC0
ShowWindow.USER32 ref: 00007FF7C99C7C96
ShowWindow.USER32 ref: 00007FF7C99C7CC3

Strings

RarHtmlClassName, xrefs: 00007FF7C99C7C4B

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction ID: f8677c60fbb11808dea3a7441e2abb99fc6a2d00e96e53605095d5a36eaf07f5
Opcode Fuzzy Hash: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction Fuzzy Hash: 89517322A0974286EBA4AF21E85477EFBB0FBC5BA0F944435DA4E47B55DF3CE0458B10

Function 00007FF7C99CFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF7C99CFF60
REPLACEFILEDLG, xrefs: 00007FF7C99CFF34, 00007FF7C99CFF99

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: ee27ab43cfd9346b5627931b7768aafca4f71288b1eaa626245dbbbc8e5bf573
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: 9121E621909A4781FBD0AF25AC44578BFB0EB8ABA4F941036D94E43360DE3CE595DB20

Function 00007FF7C99DBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7C99DBFD0
GetProcAddress.KERNEL32 ref: 00007FF7C99DBFE6
FreeLibrary.KERNEL32 ref: 00007FF7C99DC00B

Strings

CorExitProcess, xrefs: 00007FF7C99DBFDF
mscoree.dll, xrefs: 00007FF7C99DBFC7

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: 1be8397b969e864d81a4dd3565b05bc9e611c34111aef67d8f8f60c085a8f148
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 93F06222A1DA4281EFC4AF51F484279BB70EFC8BA4F841035D94F46665EE3CE484C720

Function 00007FF7C99E45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99E4605

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: aeef24c34ebeb011bd9558c9ed656ca35411a1e5ec7af199a757dfccb1620070
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 5A81AD22E1C65289F7A0AF6598806BDBFB5BB85BA8F804135CD0E53B95CF3DE441C324

Function 00007FF7C99B3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7C99B3BBB
CreateFileW.KERNEL32 ref: 00007FF7C99B3C24
SetFileTime.KERNEL32 ref: 00007FF7C99B3CEC
CloseHandle.KERNEL32 ref: 00007FF7C99B3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B3D2C

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction ID: 62d381e7a0c93dbe75788b5dd9a0924130ad492fc9ac35655776b1e003aa2279
Opcode Fuzzy Hash: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction Fuzzy Hash: C651E422B09A4249FBA0EFB5E4553BDAB71ABC4BB8F844635DE1D46BD8DE3C94058310

Function 00007FF7C99E3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C99E4767), ref: 00007FF7C99E3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF7C99E406D
WriteFile.KERNEL32 ref: 00007FF7C99E4093
WriteFile.KERNEL32 ref: 00007FF7C99E40D2
GetLastError.KERNEL32 ref: 00007FF7C99E410A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 694a7c0b92f4d99c04b4ee0707eef7b6b02701ad3f8fc0b712e242bd60d0f5da
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 2D51D032A18A5189EB50DF65D8443BCBBB0FB987A8F448135CE4E57B99DF38D085C720

Function 00007FF7C99D1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7C99B4DF4), ref: 00007FF7C99D1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7C99B4DF4), ref: 00007FF7C99D1F09
SysAllocString.OLEAUT32 ref: 00007FF7C99D1F16

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: d07b7da074abff0e0d457bce77dac1cb0a8e060b1f374ff54e111f1298ea021c
Instruction ID: 7dc0bdb2c4941f08bb551d6b08fb33a4146b62d7383c2c4a0963806b8f5e6b7e
Opcode Fuzzy Hash: d07b7da074abff0e0d457bce77dac1cb0a8e060b1f374ff54e111f1298ea021c
Instruction Fuzzy Hash: 3841FD33A0974585E7A8AF669484378AAB0FF84BF4F944634EA6D477D5DF3CE1418320

Function 00007FF7C99DF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7C99DF536

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: e535b111b5176e69a9f732663d1fb1e0e1f0944958b9b7733e5d863d147c485a
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 10412923B29A0281FB95AF126848175FAB1BF98BF0F994535DD2F4B744EE3CE4508360

Function 00007FF7C99E56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C99E56FF
_set_statfp.LIBCMT ref: 00007FF7C99E571A
_set_statfp.LIBCMT ref: 00007FF7C99E5736
_set_statfp.LIBCMT ref: 00007FF7C99E5772

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: b9d34e2384b52c5f11d823ed6d9fcbe9f8b0030f73d2978b1f5760c6fba4f55e
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 8411D076E0C607C1FFD43D24E042379B8656FD83B0EC84234EA7D461D68E6DE850412B

Function 00007FF7C99CFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF7C99CFE41
GetMessageW.USER32 ref: 00007FF7C99CFE58
TranslateMessage.USER32 ref: 00007FF7C99CFE63
DispatchMessageW.USER32 ref: 00007FF7C99CFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF7C99CFE7C

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 9fc50ba5c05fd9c86daf7f289fbc98827de2dd14aad66f0e45d5d6995dbf2b2d
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: C1F04F21B2844682F790AF30E868E3AB631FFF8B15FD41030E54F82994DE2CD149DB20

Function 00007FF7C99D625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C99D6286
abort.LIBCMT ref: 00007FF7C99D64EA

Strings

csm, xrefs: 00007FF7C99D62AB
csm, xrefs: 00007FF7C99D641A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: bd6ed162b101ecc49204d6dccea67921d5bc3b3e497c7ef847b72558390ba317
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 8E71B27360868186D7A0AF25D09877DFFB0EB85BA9F448135DA8C47A89CF3CD491C760

Function 00007FF7C99D80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99D811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99D82ED

Strings

, xrefs: 00007FF7C99D8276
*, xrefs: 00007FF7C99D8221

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 79e9fd2cba74bab6aded804a128fe8f0a11db955fd1b32021a843c2785024f60
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: B251657390C6428AE7E4AF2A84CD37CBFB0FB86B68F941175C74A5119ACF28D485C625

Function 00007FF7C99E1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7C99E17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF7C99E1894
GetStringTypeW.KERNEL32 ref: 00007FF7C99E18AE

Strings

$%s, xrefs: 00007FF7C99E175A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: da8a7f4d44df605e1ec408e4c2841057cf2c755b66831af960f1f1dd3ee59b85
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 4A418222B19B854AFBA09F25D8406A9B7B5FB94BB8F880631DE1D077C4DF3CE5418310

Function 00007FF7C99D66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99D5210: abort.LIBCMT ref: 00007FF7C99D5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C99D674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7C99D6776

Strings

csm, xrefs: 00007FF7C99D6876

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 53aedf152b6169e0bab17d9347729c1c2a533a0caf9ad12f87d04431d4a36618
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 8F513B7361974187EBA0AF16A08466EBBB4FBC9BA1F940134DB8D47B55CF38E450CB11

Function 00007FF7C99E4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7C99E4446
WriteFile.KERNEL32 ref: 00007FF7C99E4479
GetLastError.KERNEL32 ref: 00007FF7C99E449B

Strings

U, xrefs: 00007FF7C99E4424

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: dc9c864ce773dd4964d6467dce1804927d62a9ec5f64da44a947fb63e1cd50e0
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: F9418222719A8182DB909F65E8443B9BBA1FB987A4F844131EE4D87798EF7CD441C760

Function 00007FF7C99C90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C99C90D9
GetObjectW.GDI32 ref: 00007FF7C99C9107
ReleaseDC.USER32 ref: 00007FF7C99C91BB

Strings

, xrefs: 00007FF7C99C9153

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: f6c931c9cae0261f5b0520dcf4930a18b6e447600903061ca2ab59de06ba4c92
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 3B313C3560874186EB88AF22B818A2ABB70F789FE1F905435ED4B43B54CE3CD459DB10

Function 00007FF7C99BE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF7C99C317F,?,?,00001000,00007FF7C99AE51D), ref: 00007FF7C99BE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF7C99C317F,?,?,00001000,00007FF7C99AE51D), ref: 00007FF7C99BE8CB
CreateEventW.KERNEL32(?,?,?,00007FF7C99C317F,?,?,00001000,00007FF7C99AE51D), ref: 00007FF7C99BE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF7C99BE900

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 7f1495333dc14a81a5bd6b65b33f715efcdb527559830de2818e190fa8bf8a3f
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: D521E732E19A4186F790AF65E4547BD7AB2FBC4B2CF588034CA0D0B295CF7E9485C7A0

Function 00007FF7C99C85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C99C85EC
GetDeviceCaps.GDI32 ref: 00007FF7C99C85FD
ReleaseDC.USER32 ref: 00007FF7C99C860A

Strings

, xrefs: 00007FF7C99C8610

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: adeb31a1d52ccac367426d60e46d89cd61b26323d7872c3a067bd97697b13a42
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 59E08C20B0864182EFC86FB6B58982EA261AB4CBE0F65A035DA1F43794DE3CC4D48310

Function 00007FF7C99AD1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF7C99AD46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AD560

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction ID: a2711ae44dcfa0166698f4ee86efe0a1e01ea3796f70a497994d6fa5b549a730
Opcode Fuzzy Hash: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction Fuzzy Hash: 21A1B262A18A8281EB60EF65D8451ADAB71FFC57A4FC05131EE9D03AE9DF3CE544C720

Function 00007FF7C99C0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C99C05FC
SetLastError.KERNEL32 ref: 00007FF7C99C0697

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: a1a85338bd98e6dbbf4cbb69018a0b2acca20fb05f372e3efc38fb1d82780d4d
Instruction ID: 4120e9fe916ab78b60032559f6037639a7a6dac37a39db9317e028d107568af4
Opcode Fuzzy Hash: a1a85338bd98e6dbbf4cbb69018a0b2acca20fb05f372e3efc38fb1d82780d4d
Instruction Fuzzy Hash: 99519162B14A4299FF40AF75D8442ECA731EBC5BE8F904231EA5C177D6EE2CE644C360

Function 00007FF7C99C9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C99C9DBC
GetLastError.KERNEL32 ref: 00007FF7C99C9E08
CreateDirectoryW.KERNEL32 ref: 00007FF7C99C9F10
LocalFree.KERNEL32 ref: 00007FF7C99C9F20

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: b863cc91c4db730fc30b640aae8101ad1aab9759ecbd7d6557df89d0553ffb74
Instruction ID: 76d8bac0a15befb8ef87103d049e4b0f460a91144e1dd0a7030164af4bddab39
Opcode Fuzzy Hash: b863cc91c4db730fc30b640aae8101ad1aab9759ecbd7d6557df89d0553ffb74
Instruction Fuzzy Hash: 8B518032A18B4286E7809F61E8447AEBBB4FBC5BA4F901035EA4E57B54DF3CD914CB50

Function 00007FF7C99DDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF7C99DDC81
GetLastError.KERNEL32 ref: 00007FF7C99DDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DDCD6

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 6569c19c49f309ad0d62f9925927f474da43c10124b168b4969311e05739b495
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 9841A433A0C64246F7A1AF2491C8379EAB0EFD0BB4F944131DA4D46EE5DF6DD8418720

Function 00007FF7C99B3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF7C99B39BD
MoveFileW.KERNEL32 ref: 00007FF7C99B3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B3AF1

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction ID: 4b68ade265a1935d737b3057e30420efda5ed9dbdc34d02512b7dd4e2982c1e0
Opcode Fuzzy Hash: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction Fuzzy Hash: C841E062F15B5184FB40EFB5D8852ACB771BF84BB8B901231DE1D26A99DF3CD040C210

Function 00007FF7C99E0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7C99DC45B), ref: 00007FF7C99E0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7C99DC45B), ref: 00007FF7C99E0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7C99DC45B), ref: 00007FF7C99E0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7C99DC45B), ref: 00007FF7C99E0C57

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: cb5c53ee98d68fdc3c7836b335dd6c05f4b49fa0ff561cd4b8f240fe5c7d7629
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: BF213031A1DB5181EBA4AF126440029FBB4FBD8BE0B8C4174DE9E63BA5DF3CE4528714

Function 00007FF7C99DD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7C99D7F28,?,?,?,00007FF7C99D9D35), ref: 00007FF7C99DD44A
SetLastError.KERNEL32(?,?,?,00007FF7C99D7F28,?,?,?,00007FF7C99D9D35), ref: 00007FF7C99DD4B2
SetLastError.KERNEL32(?,?,?,00007FF7C99D7F28,?,?,?,00007FF7C99D9D35), ref: 00007FF7C99DD4C8
abort.LIBCMT ref: 00007FF7C99DD4CE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 3b91d87becc86292b1631f146ba84788e4f2d9bcad0293b4cc6779fc376cf182
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 3D012D12A0960642FBD87F65A69E178D9715FD87F0F844438D91E02BE6ED2CB9458230

Function 00007FF7C99C8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C99C8598
GetDeviceCaps.GDI32 ref: 00007FF7C99C85AE
GetDeviceCaps.GDI32 ref: 00007FF7C99C85C2
ReleaseDC.USER32 ref: 00007FF7C99C85D3

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 1fec8907619d6d3d9b38a3f41663cdd09a8f333d9add613ee368d428b1a9f001
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 24E0ED60E0960282FFCC7F71685993ABAB0AF48B61F98947AC81F47350DD3CA095D620

Function 00007FF7C99AE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99AE549

Strings

DXGIDebug.dll, xrefs: 00007FF7C99AE35A

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 2b89549b7426e50bfd34945384ed8c0e8b0bf6c6c1231d7991053c614d04a2bf
Instruction ID: e871640294b8fe55abdff67904199b8661b7c4efa2b4ce4989abc4687b41879b
Opcode Fuzzy Hash: 2b89549b7426e50bfd34945384ed8c0e8b0bf6c6c1231d7991053c614d04a2bf
Instruction Fuzzy Hash: 6471BD72A14B8186EB64DF65E9443ADB3B8FB947A4F804225DFAC03B95DF38D151C310

Function 00007FF7C99DE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DE237

Strings

gfff, xrefs: 00007FF7C99DE362
e+000, xrefs: 00007FF7C99DE2DF

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 23c2e43cc2f35f84a0ff17b1b8bda1306eacdad9e896b96687704d933bebe062
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 83510363B187C146E7A59F759985369EEA1ABC1BA0F888231CB9C87BD5CF2CD444C720

Function 00007FF7C99B9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99B95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99B95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C99B95A2

Strings

SIZE, xrefs: 00007FF7C99B9443

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: 08e483b071e5099ada1b8f00573bf2153e7bbb966868f6a9364650d99557a688
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: 0C41C363A2868295EBA0EF14E4453BDA770EFC57B8F904231EE9D066D6EE7CD540C720

Function 00007FF7C99DC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C99DC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7C99D2CD5), ref: 00007FF7C99DC30B

Strings

C:\Users\user\Desktop\442.docx.exe, xrefs: 00007FF7C99DC2F9

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\442.docx.exe
API String ID: 3307058713-3798399066
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: ec774e4fcad5808472258ed96a78b4bc43c029bae2b868cce4c0bf656870e313
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 87416533A0865286EB94EF25A8850BDFBB4EFC47E4B845035E94E47B95EE3DE441C360

Function 00007FF7C99C9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C99A255C: GetDlgItem.USER32 ref: 00007FF7C99A25AC
Part of subcall function 00007FF7C99A255C: SetWindowTextW.USER32 ref: 00007FF7C99A25C8

EndDialog.USER32 ref: 00007FF7C99C9C24
SetDlgItemTextW.USER32 ref: 00007FF7C99C9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF7C99C9B72

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction ID: b51f7fe202f400db4365ec9e905e28ef499cf6146a69e4587e87d3ab3c0b4d3f
Opcode Fuzzy Hash: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction Fuzzy Hash: B4417F22A0868281FBD4BF22E8542B9ABB1EFC5BE1F944035DE4E07795CE3DE541C760

Function 00007FF7C99B9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C99B96EA

Part of subcall function 00007FF7C99C0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7C99C0F99

Strings

$%s, xrefs: 00007FF7C99B96D7
@%s, xrefs: 00007FF7C99B96CE

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 5f2de7db36c021696465f58f22312002f60e029c16342c3ae583f515b6f4c7ee
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 7631C672B29A4685EBA0EF66D4406E9ABB0FB85BE8F801032DE0D07755DE3CE505C750

Function 00007FF7C99DEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7C99DEB76
GetFileType.KERNEL32 ref: 00007FF7C99DEB8C

Strings

@, xrefs: 00007FF7C99DEBB7

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 466fa9034856f7bcd103dbd6a8ea7f5ec3c97cde71ae2fdc7498e832f7817bec
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 29217133A08A8241EBA4AF6694D4139AE61EB85774FAC1335D66F077D4CE3DE881C321

Function 00007FF7C99D4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C99D1D3E), ref: 00007FF7C99D40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C99D1D3E), ref: 00007FF7C99D4102

Strings

csm, xrefs: 00007FF7C99D40EF

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 63f8875d63f356942934985eb12f5bf13cdda79849041a7839a6895d1bab4659
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 6B118F32608B4182EB609F15E444269BBF0FB88BA4F584230DF8C07B94DF3CC551C740

Function 00007FF7C99BEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C99BE95F,?,?,?,00007FF7C99B463A,?,?,?), ref: 00007FF7C99BEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C99BE95F,?,?,?,00007FF7C99B463A,?,?,?), ref: 00007FF7C99BEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF7C99BEA78

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: fcd8821df67ac3958fbe3c135e86dbac5b6ea928cb98aa187bf9158d0a814e22
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 69E0E565E1984281E790BF66AC565A8BA30BFA17B0FD01330D03E425E19E6CA985C320

Function 00007FF7C99BA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C99BA447
FindResourceW.KERNEL32 ref: 00007FF7C99BA45D

Strings

RTL, xrefs: 00007FF7C99BA453

Memory Dump Source

Source File: 00000000.00000002.2056898409.00007FF7C99A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C99A0000, based on PE: true

Associated: 00000000.00000002.2056803124.00007FF7C99A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057143242.00007FF7C99E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C99FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057211844.00007FF7C9A04000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057430253.00007FF7C9A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c99a0000_442.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 8cf5d17ddb992ecebf32356a8fea844e08e178d49d7e54124db1e6fca97661fe
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 4DD05B91F0D60141FF596FB654453356A705F5CB51FC44078CC0D06350DE2CD5C4C760

Analysis Process: rfusclient.exePID: 7372, Parent PID: 760COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1056
Total number of Limit Nodes:	13

Executed Functions

Function 5FFF6B90 Relevance: 19.6, APIs: 13, Instructions: 128
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 5FFF6BAD
CreateEventA.KERNEL32 ref: 5FFF6BD5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 5FFF6C17
GetCurrentThread.KERNEL32 ref: 5FFF6C1B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 5FFF6C23
DuplicateHandle.KERNELBASE ref: 5FFF6C4F
GetThreadPriority.KERNEL32 ref: 5FFF6C66
TlsSetValue.KERNEL32 ref: 5FFF6C92
TlsGetValue.KERNEL32 ref: 5FFF6CD0
abort.MSVCRT(?,?,?,431BDE83,5FFF9B07), ref: 600A242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,5FFF9B07), ref: 600A246C
GetProcAddress.KERNEL32 ref: 600A248C
GetProcAddress.KERNEL32 ref: 600A24A0

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: Current$Thread$AddressHandleProcProcessValue$CreateDuplicateEventModulePriorityabort
String ID:
API String ID: 1214264455-0
Opcode ID: eed263bcffcf603b348ed6e7d36ec53c1885d35bf7608f7aded1f0ddc6ae427f
Instruction ID: 7a14a4b59bc2894bb144a9c080ff3c683cb04df854c5572ea3da19dfa70fac8f
Opcode Fuzzy Hash: eed263bcffcf603b348ed6e7d36ec53c1885d35bf7608f7aded1f0ddc6ae427f
Instruction Fuzzy Hash: 58411AB18153008FDB00AF79D98936ABFF4FF45314F00866DE88497266E7B9D454CB92

Function 5FFE8BA0 Relevance: 24.1, APIs: 16, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 600A2382
abort.MSVCRT ref: 600A2387
abort.MSVCRT ref: 600A238C
abort.MSVCRT ref: 600A2394
abort.MSVCRT ref: 600A2399
abort.MSVCRT ref: 600A239E
abort.MSVCRT ref: 600A23A3
abort.MSVCRT ref: 600A23A8
abort.MSVCRT ref: 600A23AD
abort.MSVCRT ref: 600A23B2
abort.MSVCRT ref: 600A23B7
abort.MSVCRT ref: 600A23BC
abort.MSVCRT ref: 600A23C1
abort.MSVCRT ref: 600A23C8
abort.MSVCRT ref: 600A23CD

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 48a6b962c79ad736dfd95aff3798e85babf97129c6d4264baa583080730b197b
Instruction ID: fa21f702ee0785723a9ecd3622445400cd93bcabd3c61d91a949977216c58f2b
Opcode Fuzzy Hash: 48a6b962c79ad736dfd95aff3798e85babf97129c6d4264baa583080730b197b
Instruction Fuzzy Hash: CA0196F19153468FD700EFB9C49572A7FE47F52300F890856D8809BB62D738D988D7A2

Function 5FFF4970 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 5FFF4989
_unlock.MSVCRT ref: 5FFF49B1
calloc.MSVCRT ref: 5FFF49FF

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction ID: 88931d2cc509c63ea0f6b0b42023c23751b180953b7cb40b1d3b3f000900328c
Opcode Fuzzy Hash: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction Fuzzy Hash: 64115EB16052118FDB50DF68C58075ABBE4FF88210F1986AAD898CF795EB74D840CBA2

Function 5FD612F0 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 5FD6134C

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: c5867198dcf9d073290aeebe08f7977020d2962c7d55e0156b73189909da6f16
Instruction ID: 7ffc36f6165f55670b666bed1a144f644ff91c92891282ed7f1f98db5c8965d5
Opcode Fuzzy Hash: c5867198dcf9d073290aeebe08f7977020d2962c7d55e0156b73189909da6f16
Instruction Fuzzy Hash: 1F1161B12093019BDB80BF69D98066FBFE4AF84B58F404D1EE4C9CB652D774E4408BD2

Non-executed Functions

Function 5FFF6AD0 Relevance: 10.6, APIs: 7, Instructions: 93
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5FFF64C0: calloc.MSVCRT ref: 5FFF654E

TlsAlloc.KERNEL32(?,?,00000000,5FFF801E,?,?,?,431BDE83,5FFF9B07), ref: 5FFF6B04
fprintf.MSVCRT ref: 5FFF6B69
abort.MSVCRT(?,?,?,431BDE83,5FFF9B07), ref: 600A2425
abort.MSVCRT(?,?,?,431BDE83,5FFF9B07), ref: 600A242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,5FFF9B07), ref: 600A246C
GetProcAddress.KERNEL32 ref: 600A248C
GetProcAddress.KERNEL32 ref: 600A24A0

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: AddressProcabort$AllocHandleModulecallocfprintf
String ID:
API String ID: 2703921052-0
Opcode ID: 69d00d08606af822ef26000beceb18d22f811bb46117775cb4a03793b004624d
Instruction ID: 0df4474d9d31aab45def323963c4d699aae743b07e8dd9f7d5ff8da707a69315
Opcode Fuzzy Hash: 69d00d08606af822ef26000beceb18d22f811bb46117775cb4a03793b004624d
Instruction Fuzzy Hash: E6317CB29253009FDB00AF68D88936ABFE4FF55214F05452EE588E7371DBB59440CB92

Function 5FC345A0 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 6009DBF0: malloc.MSVCRT ref: 6009DC07

memcpy.MSVCRT ref: 5FC345FE
memcpy.MSVCRT ref: 5FC3464B

Strings

(`, xrefs: 6009EE16

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: memcpy$malloc
String ID: (`
API String ID: 962570267-3480472747
Opcode ID: 0378db273d80f09f69880694f6c11813800ebd8fd1acc1395f3417ca60553f43
Instruction ID: 7d78f9cb8055bc4bb5729689fb738e2cb4e271a0d4b909822f3f131b52d550e7
Opcode Fuzzy Hash: 0378db273d80f09f69880694f6c11813800ebd8fd1acc1395f3417ca60553f43
Instruction Fuzzy Hash: 36613DB19097818ED340DF68C58035FBFE0BFE6348F114A6EE4C4A7262E7B59584DB92

Function 5FC33D30 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC33DDA

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ca802f03bfa68888f8359a9990aef875cd53c326e60076e970967c8f7cfa5c67
Instruction ID: 9c39a18c0730e5cdb2da9b8b1286974b5a999fa66db4398415aec1d703ebabbe
Opcode Fuzzy Hash: ca802f03bfa68888f8359a9990aef875cd53c326e60076e970967c8f7cfa5c67
Instruction Fuzzy Hash: B451DFB4D543589FCB04DFA9C480ADEBBF4BF89344F10852EE844AB395E774A845CB91

Function 5FC342D0 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC3437A

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d9be2dce889c820a21046f333fe25b32e2d89f6ada6bc510bb6d89bfef96a538
Instruction ID: b23198aa7ced68edeb3eb1d46587fe985c109be459800d9d7f86314c2902c7cb
Opcode Fuzzy Hash: d9be2dce889c820a21046f333fe25b32e2d89f6ada6bc510bb6d89bfef96a538
Instruction Fuzzy Hash: D351D0B4D153589FCB00DFA9C480ACEBBF4BF89344F11856EE844AB399E774A845CB91

Function 5FC34000 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC340AA

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2d76632ee9c5477d69948677a5822199bbe7f8ddfcf921de88a7a9e01587faba
Instruction ID: 1be26a4be4452bbc27358c7b8d678638e5557b292b0b5b0e46592b6ac9207b5c
Opcode Fuzzy Hash: 2d76632ee9c5477d69948677a5822199bbe7f8ddfcf921de88a7a9e01587faba
Instruction Fuzzy Hash: AC51DFB4D143589FCB00DFA9C880ACEBBF4BF89344F11856EE844AB395D775A849CB91

Function 5FC33AE0 Relevance: 1.3, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc72ea6f1c14dfa902ebf7a507373ce5dca28c9880e00ec4599b0a8fdd5d75c
Instruction ID: 19328ac630b178432173e1841aae5311330db6e6b3408e465a25e6c4d945fca5
Opcode Fuzzy Hash: 2cc72ea6f1c14dfa902ebf7a507373ce5dca28c9880e00ec4599b0a8fdd5d75c
Instruction Fuzzy Hash: C531D1B09083409FC3509F29C48034BBBE5BBC9798F504A2DF9989B260D774A9458B92

Function 5FC33760 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b14e1bc13f48eece9efdb52935c3adbedb779fd751b4c2db2af895439a1b13
Instruction ID: ae330e319ee5587d6256d91570500ab74add99f3fbc6e113b54e896253f05db4
Opcode Fuzzy Hash: 26b14e1bc13f48eece9efdb52935c3adbedb779fd751b4c2db2af895439a1b13
Instruction Fuzzy Hash: 2931D2B06097818FC700AFA9C58431FBBE2BFD5244F119C2DA5C08B255DB78D849CB92

Function 5FC338C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde55884ab3512234ebd07cee1cbba1e9557f3ca6fb90b0089b7a65ce89106ee
Instruction ID: 468e80eea538aa33929c66421f826567b54d87d4d4b4f042066fe8160328c7f2
Opcode Fuzzy Hash: fde55884ab3512234ebd07cee1cbba1e9557f3ca6fb90b0089b7a65ce89106ee
Instruction Fuzzy Hash: 3431E2B0A097818FC700AFA9C98431FBAE1BFD5244F119C2EE5C08B355DB78D849CB92

Function 5FFFBEB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction ID: 7a28bb3c19099943a6eb86a699ad70260470d30c4f3065664d8d3081c6443532
Opcode Fuzzy Hash: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction Fuzzy Hash: FFC012B0C082408AC200BF38860A228FAB06B62208F842CACE48013202E739C018A69B

Function 5FFF9640 Relevance: 19.8, APIs: 13, Instructions: 272
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 5FFF9678
GetThreadTimes.KERNEL32 ref: 5FFF96A1
GetSystemTimeAsFileTime.KERNEL32 ref: 5FFF9717
QueryPerformanceFrequency.KERNEL32 ref: 5FFF9757
QueryPerformanceCounter.KERNEL32 ref: 5FFF976F
GetCurrentProcess.KERNEL32 ref: 5FFF9818
GetProcessTimes.KERNEL32 ref: 5FFF9841
_errno.MSVCRT ref: 5FFF9852

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: 9067be0ed3d1f93a274ea68dfeb14be4576229c482e0c607cdd9c7c17fe6354e
Instruction ID: 32be8752b78a214fca3ca32c0b4e36de125b7e39be2b1e779ddbcad5f0867ab8
Opcode Fuzzy Hash: 9067be0ed3d1f93a274ea68dfeb14be4576229c482e0c607cdd9c7c17fe6354e
Instruction Fuzzy Hash: 39B102B55083008FC710EF68C98855ABFF6FF89354F058A2EE895D7664E7B4E544CB82

Function 5FFF54A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 5FFF54DD
CreateSemaphoreA.KERNEL32 ref: 5FFF551F
CreateSemaphoreA.KERNEL32 ref: 5FFF5546
InitializeCriticalSection.KERNEL32 ref: 5FFF5565
InitializeCriticalSection.KERNEL32 ref: 5FFF5570
InitializeCriticalSection.KERNEL32 ref: 5FFF557B

Strings

l, xrefs: 5FFF54CE

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: fdb783dff1ea43411ab62f9ecf23e0a01d725d68fb43330a0a8b487026a6847f
Instruction ID: ad30669fa334862c45e6ce4555e22d032633ad03de5198e28c8cc21728369ff5
Opcode Fuzzy Hash: fdb783dff1ea43411ab62f9ecf23e0a01d725d68fb43330a0a8b487026a6847f
Instruction Fuzzy Hash: 50416DB25043008FEB00AF68D98839ABFF4EF41314F198A6DD9549B695E775E454CB82

Function 5FFFBB90 Relevance: 15.2, APIs: 10, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca679e1bb5c40de951910998f2a401aa212a88ccbc987e4876e091e60ab303c
Instruction ID: e9dc93a2203cc16e5e477ebc2ea31ce51d1374b08ec8f3363e6c8e2b3cf39e7f
Opcode Fuzzy Hash: eca679e1bb5c40de951910998f2a401aa212a88ccbc987e4876e091e60ab303c
Instruction Fuzzy Hash: 0B71EDB15483068FC700AFB8C48276EBBE4AF61304F45980EE6C4DB665DF749445EBA3

Function 5FFF5620 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 201
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5FFF7AC0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000030,76EBE820), ref: 5FFF7AD0

Part of subcall function 5FF4FE90: WaitForMultipleObjects.KERNEL32 ref: 5FF4FF03

ResetEvent.KERNEL32 ref: 5FFF569F

Part of subcall function 5FFF7E30: TlsGetValue.KERNEL32(?,?,00000000,?,5FFF8065,?,?,?,?,431BDE83,5FFF9B07), ref: 5FFF7E42

WaitForSingleObject.KERNEL32 ref: 5FFF56DF

Strings

(, xrefs: 5FFF576D

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: ValueWait$EventMultipleObjectObjectsResetSingle
String ID: (
API String ID: 2327612466-3887548279
Opcode ID: b75b9a09ad8f3cde3994685d98b4825ee91b49a0826c665d22f66ab450ef0ec5
Instruction ID: 0969e11b83bd1b176e66376b70ea96041602d041a2bc42df185d38844456947b
Opcode Fuzzy Hash: b75b9a09ad8f3cde3994685d98b4825ee91b49a0826c665d22f66ab450ef0ec5
Instruction Fuzzy Hash: D06190F2915315CBD710AFB585C829ABEE0AF81750F0D482EE984D7A71E635E844CBE3

Function 5FCE7610 Relevance: 12.4, APIs: 3, Strings: 5, Instructions: 406
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 5FCE778A

Strings

, xrefs: 5FCE76EF
, xrefs: 5FCE7C15
0123456789abcdef, xrefs: 5FCE76F7
0123456789ABCDEF, xrefs: 5FCE76EA
+, xrefs: 5FCE7BE8

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: strlen
String ID: $ $+$0123456789ABCDEF$0123456789abcdef
API String ID: 39653677-2690344263
Opcode ID: 1a21a3df6995429868e2b49fa40a9c125693253f52368ef8a7b184028daec450
Instruction ID: 7f2944f89d7b97d2cc4757f5bda50754d8c9f3289deec1a6d6d84b3087c59477
Opcode Fuzzy Hash: 1a21a3df6995429868e2b49fa40a9c125693253f52368ef8a7b184028daec450
Instruction Fuzzy Hash: 440229B46093418FC721CF29C08075BBBE1BF89748F148D2DEAA89B352D775E944CB92

Function 5FCDFC10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToFiber.KERNEL32(?,?,?,?,5FC31CE1,5FC470E0,?,5FC4742C,?,?,?,?,?,?,?,?), ref: 5FCDFCB9
memcpy.MSVCRT(?,?,?,?,?,5FC31CE1,5FC470E0,?,5FC4742C,?,?,?,?,?,?,?), ref: 5FCDFD50
SwitchToFiber.KERNEL32(?,?,?,?,?,5FC31CE1,5FC470E0,?,5FC4742C,?,?,?,?,?,?,?), ref: 5FCDFD7C

Strings

`, xrefs: 5FCDFFFE

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: FiberSwitch$memcpy
String ID: `
API String ID: 148397844-2679148245
Opcode ID: 444701f359683095bb3db78f7751f4cb81eea3dddb63ac2f1d3d76753b21bd55
Instruction ID: d21574f7e487a5ff70d30af91726ea57ae8563cb5a0fe7b1ca6deff5b9305ad8
Opcode Fuzzy Hash: 444701f359683095bb3db78f7751f4cb81eea3dddb63ac2f1d3d76753b21bd55
Instruction Fuzzy Hash: 1AD1E2F050A7459BDB40AF64D09471FBBE0BF80784F05892DE9D88B245DBB9D885CBE2

Function 5FFF7E30 Relevance: 10.6, APIs: 7, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5FFF6AD0: TlsAlloc.KERNEL32(?,?,00000000,5FFF801E,?,?,?,431BDE83,5FFF9B07), ref: 5FFF6B04

TlsGetValue.KERNEL32(?,?,00000000,?,5FFF8065,?,?,?,?,431BDE83,5FFF9B07), ref: 5FFF7E42

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: AllocValue
String ID:
API String ID: 1189806713-0
Opcode ID: f4d5cdfc348a1c3406f79f8fb14f8edac9c6a3a47dc0a3868a5645fcfe61ada4
Instruction ID: 4b00fe2f7d7fc9cb4a1d44555fa5dda40714144c9955a131475c5b2af77580dd
Opcode Fuzzy Hash: f4d5cdfc348a1c3406f79f8fb14f8edac9c6a3a47dc0a3868a5645fcfe61ada4
Instruction Fuzzy Hash: F84186F36157014BDB007FB8988866ABFA4EF01214F094A6AD856CB6B6FA74D840C7D2

Function 5FFF66E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 5FFF671E
OutputDebugStringA.KERNEL32 ref: 5FFF6743
abort.MSVCRT ref: 5FFF674C
fprintf.MSVCRT ref: 5FFF680C

Strings

5, xrefs: 5FFF6730

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabortfprintf
String ID: 5
API String ID: 4086887302-2226203566
Opcode ID: f9a743ee97d0825423d7f0e6982a268516166e290af4dc7e070a4879f699654c
Instruction ID: e45beb523e02dbb2a678baa97d953e1b5d11d56ea7d3a5c548cb761f5e013528
Opcode Fuzzy Hash: f9a743ee97d0825423d7f0e6982a268516166e290af4dc7e070a4879f699654c
Instruction Fuzzy Hash: 563166F28157019BCB00AFB4C89479EBFF4BF44304F058A2DD899D7661EB74A584CB92

Function 5FFF7BB0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 5FFF6B90: TlsGetValue.KERNEL32 ref: 5FFF6CD0

longjmp.MSVCRT ref: 5FFF7BE6
TlsGetValue.KERNEL32(?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE,?,?,?,00000000,?), ref: 5FFF7BF4
CloseHandle.KERNEL32(?,?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE,?,?,?,00000000), ref: 5FFF7C1B
_endthreadex.MSVCRT(?,?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE,?,?,?,00000000), ref: 5FFF7C30
CloseHandle.KERNEL32(?,?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE,?,?,?,00000000), ref: 5FFF7C42
TlsSetValue.KERNEL32(?,?,?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE), ref: 5FFF7C63
CloseHandle.KERNEL32(?,?,?,?,0000001C,5FFF7D9F,?,?,?,?,00000000,5FFF7EDE,?,?,?,00000000), ref: 5FFF7C7A

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 8cd7c540be347e958f29b062bdf8dc7414b9956c295db2388ae430956c97dd5c
Instruction ID: ee59aa62ab4c3a21d7f7d04fae1a36f5235ef3d8fca4cebc91ff5cb2a65b6cfb
Opcode Fuzzy Hash: 8cd7c540be347e958f29b062bdf8dc7414b9956c295db2388ae430956c97dd5c
Instruction Fuzzy Hash: 7E21E9F16157008FDB01AF74C9CC666BFE8EF09704F058869E985DB666E7B4D840CBA1

Function 6009DBF0 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6009DC07

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 6206a06ccd407bad243e07bfe800e85e46b0d8543e7a4d390109db0781216af3
Instruction ID: 10098b23ae91197f68c9ac6d70324ea245b277192757d5babcd4273e379e4317
Opcode Fuzzy Hash: 6206a06ccd407bad243e07bfe800e85e46b0d8543e7a4d390109db0781216af3
Instruction Fuzzy Hash: 01210CB05593418FD300BFB8C54672EBAE4AF65304F41A81DE5D89B256DBB48840EBA3

Function 5FCDF8F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

e, xrefs: 5FCDFB09
`, xrefs: 5FCDFB68

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID:
String ID: `$e
API String ID: 0-2074502723
Opcode ID: a06c4c5b33b08ba6e30801fdecc13fa0a8c6228509352896d1fb7ad63313f481
Instruction ID: 24b542c01a74d3f87200467693a6f3cc7295b6b84a14c08d411f1a281bfbf3bd
Opcode Fuzzy Hash: a06c4c5b33b08ba6e30801fdecc13fa0a8c6228509352896d1fb7ad63313f481
Instruction Fuzzy Hash: EF71B1F050A346ABD740AFA4D49475FBAE4BF80798F01882DE5C98B251D7B9D484CBE3

Function 5FFF9E70 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 5FFF9E98
free.MSVCRT ref: 5FFF9F27
free.MSVCRT ref: 5FFF9F4F

Part of subcall function 5FFF54A0: calloc.MSVCRT ref: 5FFF54DD
Part of subcall function 5FFF54A0: CreateSemaphoreA.KERNEL32 ref: 5FFF551F
Part of subcall function 5FFF54A0: CreateSemaphoreA.KERNEL32 ref: 5FFF5546
Part of subcall function 5FFF54A0: InitializeCriticalSection.KERNEL32 ref: 5FFF5565
Part of subcall function 5FFF54A0: InitializeCriticalSection.KERNEL32 ref: 5FFF5570
Part of subcall function 5FFF54A0: InitializeCriticalSection.KERNEL32 ref: 5FFF557B

free.MSVCRT ref: 5FFF9F97

Strings

, xrefs: 5FFF9E89

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSectionfree$CreateSemaphorecalloc
String ID:
API String ID: 3430360044-3916222277
Opcode ID: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction ID: 1a3eb197f471da4313ce0937b8971a3ab67bfe03a993d8b7369fa92827acd494
Opcode Fuzzy Hash: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction Fuzzy Hash: 37317CB16193009FD314AF66E88435FBBE5EF84324F09882ED488CB695E376D449CBD2

Function 5FFF9A40 Relevance: 6.2, APIs: 4, Instructions: 165timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 5FFF9A91
GetSystemTimeAsFileTime.KERNEL32 ref: 5FFF9B28
_errno.MSVCRT ref: 5FFF9BA7
_errno.MSVCRT ref: 5FFF9BE2

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: fe0d0687a48d7144e88008d5c01635f030ea56baf31f0921f1f09efeb84f89d2
Instruction ID: 78827df70b1d67b005907acda5d40f748e6e85fa9448afa4a05c4f2cec882b91
Opcode Fuzzy Hash: fe0d0687a48d7144e88008d5c01635f030ea56baf31f0921f1f09efeb84f89d2
Instruction Fuzzy Hash: A9516DB26083048FC710DF69C98465BBBE6BFC8314F598A2DE998D7764E770D905CB82

Function 5FFFBD40 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,5FFFBC17), ref: 6009F810
abort.MSVCRT(?,?,?,?,?,?,5FFFBB6C), ref: 6009F818
abort.MSVCRT(?,?,?,?,?,?,5FFFBC17), ref: 6009F82C
abort.MSVCRT(?,?,?,?,?,?,5FFFBC17), ref: 6009F844

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 08aa0320bb69de8eebb76955aca1d4c089c30a7db2b6477e920e50f297c5641e
Instruction ID: 56c1fbe806b46733acc050b8333a9ad1403564df51e99f81a08c62df87a1a600
Opcode Fuzzy Hash: 08aa0320bb69de8eebb76955aca1d4c089c30a7db2b6477e920e50f297c5641e
Instruction Fuzzy Hash: 874106B22483068FC704DF68D4817AA77E5FF82308F18896EE184CB769DB31D806D792

Function 5FF4FB30 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 5FF4FB60
GetTickCount.KERNEL32 ref: 5FF4FB6D
QueryPerformanceFrequency.KERNEL32 ref: 5FF4FBD7

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: PerformanceQuery$CountCounterFrequencyTick
String ID:
API String ID: 713402817-0
Opcode ID: fb3646bd5c2c9e901f765ef1966b088a4ce7d3d64bfc5ac46c55006e71b39b0b
Instruction ID: 8b3da444b8b0c51a3cff9b6e481486876d64cef5d54b18151e45f9db383886f9
Opcode Fuzzy Hash: fb3646bd5c2c9e901f765ef1966b088a4ce7d3d64bfc5ac46c55006e71b39b0b
Instruction Fuzzy Hash: A33105B59083019FC704EF38D99865ABFE1BF89314F018A29E898D7794E734E549CF92

Function 5FD2BFC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 5FD2C058
strcpy.MSVCRT(?,?,?,?,?,?,5FC4C146), ref: 5FD2C089
strlen.MSVCRT ref: 5FD2C093

Strings

B, xrefs: 5FD2C01C

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: strlen$strcpy
String ID: B
API String ID: 2790333442-1255198513
Opcode ID: c62bbfd32aa233bfbc315185da103b11445fadf2e8b9db339360f7d23e5e9c4c
Instruction ID: 31326df409960131b68c9671b748794df43f81eef59a91aefc6d4458d6f5c4a3
Opcode Fuzzy Hash: c62bbfd32aa233bfbc315185da103b11445fadf2e8b9db339360f7d23e5e9c4c
Instruction Fuzzy Hash: 6F2153F180A7059FD740AF64C58479ABBE0FF80758F49486EE8888B352E775D844DBD2

Function 6007A400 Relevance: 5.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6007A49E
memmove.MSVCRT(?,?,?,?,?,00000000,00000000,?,?,5FC37F62), ref: 6007A4BE
memset.MSVCRT ref: 6007A5B4

Part of subcall function 6009DBF0: malloc.MSVCRT ref: 6009DC07

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: memset$mallocmemmove
String ID:
API String ID: 1346079573-0
Opcode ID: d3b42911c038f07576e0af3334411be014aff8536b2ed81f907fef41cc6344e3
Instruction ID: 810edde78764ecdd95e185fb1eb8d6eda50409e8ab6a13817434fd67f1684a4d
Opcode Fuzzy Hash: d3b42911c038f07576e0af3334411be014aff8536b2ed81f907fef41cc6344e3
Instruction Fuzzy Hash: C25115B16097028FC314DF29D58061AFBE1AFD9350F20C92EE8988B365D735D949CBA6

Function 5FFF5B50 Relevance: 5.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,?,5FFFA59B), ref: 5FFF5B96
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,?,5FFFA59B), ref: 5FFF5C26

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1882d716163836c3d614a7b9a1da24184421eef79858d83447bd1d423feddb59
Instruction ID: f3d99280cc1de462ebb7a8a9faf355e9ddc5cc04f83ce92e1424d2d1c40e8b8f
Opcode Fuzzy Hash: 1882d716163836c3d614a7b9a1da24184421eef79858d83447bd1d423feddb59
Instruction Fuzzy Hash: C3310BB25082008FDB04EF39D8C469ABBE0FF44314F498669EC15CB65AE731E995CB92

Function 5FFF5900 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,00000030,00000050,?,5FFF5BD1), ref: 5FFF5920
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,00000030,00000050,?,5FFF5BD1), ref: 5FFF593C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,5FFF5BD1), ref: 5FFF5979
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,5FFF5BD1), ref: 5FFF5985

Memory Dump Source

Source File: 0000000C.00000002.2188649953.000000005FC31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC30000, based on PE: true

Associated: 0000000C.00000002.2187893880.000000005FC30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199748994.00000000600A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.00000000600B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2199882753.000000006017E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201503437.0000000060265000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201528488.0000000060266000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201547808.0000000060267000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2201575734.000000006026B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5fc30000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 12eed81778f3fb155304f6a1f1e42c6c89e0aff5d32ce71b824bb9d6440df256
Instruction ID: 2932b088662d8673e7332822c4a7fa585141338b6ff05254ea44bf29daca6958
Opcode Fuzzy Hash: 12eed81778f3fb155304f6a1f1e42c6c89e0aff5d32ce71b824bb9d6440df256
Instruction Fuzzy Hash: 4211F5B5A083108FC714EF39E98550ABBE0EF89661F06492DE988D7321D231E858CB92

Analysis Process: rutserv.exePID: 7864, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	6

Executed Functions

Function 00B19A60 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000000,?,00B19B19,?,?,00B19D58), ref: 00B19AC6

Strings

gfff, xrefs: 00B19A81
gfff, xrefs: 00B19AAA

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: Sleep
String ID: gfff$gfff
API String ID: 3472027048-3084402119
Opcode ID: 775bd7b923cd56bb7696de1cfb51632b5dab49b8ce3efb35a9d81d5411332714
Instruction ID: a8c8ee7a09ac8fa2ac2597a45b30ee017015b7d6af78291346cdc3a0c9023084
Opcode Fuzzy Hash: 775bd7b923cd56bb7696de1cfb51632b5dab49b8ce3efb35a9d81d5411332714
Instruction Fuzzy Hash: E101AC717145908FDB7C993DACA17E821C6FFC1301FD442B5E902CD2C9D5B198C58243

Function 00B74F3C Relevance: 3.0, APIs: 2, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,00B750E0,00000000,00020019,?), ref: 00B74FB7
RegQueryValueExW.KERNELBASE(?,00B7513C,00000000,00000000,00000000,?,00000000,00B750CE), ref: 00B74FE5

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B73000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B73000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b73000_rutserv.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 4632d7d4344e799f2ce53669f194cf9e359f6a535158dff5000e0ec9440b48fa
Instruction ID: 4976c18437438a615d951f78290a7f2c8b599398e3fb8c1706eccb4c8b768913
Opcode Fuzzy Hash: 4632d7d4344e799f2ce53669f194cf9e359f6a535158dff5000e0ec9440b48fa
Instruction Fuzzy Hash: 8E118474A40708BBDB30EAA19C42BDE77E8EB04740F5044E9FA08E7281E7F09A44DB90

Function 01040658 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE(0000000A,00000000), ref: 0104076A

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001040000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1040000_rutserv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ab86b59b600f96e414820d435548884d2a61e234968bfeac6609859610807f4c
Instruction ID: 4d5807dfd43fa2eafd04c5242bf1577ef2c1ac86b74f17c5f2546bec344e7f02
Opcode Fuzzy Hash: ab86b59b600f96e414820d435548884d2a61e234968bfeac6609859610807f4c
Instruction Fuzzy Hash: 314159B0A04204AFEB51DB68C9C1EDDBBE5FF49310F2540E4FA85BB696D730AE44CA11

Function 01021034 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(?,?), ref: 010210E7

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001021000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1021000_rutserv.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 4322f55200d324658de4c8ad564a0d569913b1086a1a024a58c8958ca9ed6218
Instruction ID: 37bc672865d1016516e64e22fb09a27a81198eba1ec2641c3751432dc1202ba8
Opcode Fuzzy Hash: 4322f55200d324658de4c8ad564a0d569913b1086a1a024a58c8958ca9ed6218
Instruction Fuzzy Hash: 8121CE70F043A98FDB41CF7988917ADBBF5AF49300F1484B5E899EA246E77C99018B64

Function 00B1B190 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 00B1B1EA

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 358bf576e56decd8f2e7f90188ea1eefff155e9cbdee11c1dd08b084efa6ea4a
Instruction ID: 90499d4bc656283a46e3b035ad38752cc10136c22081e1547216edf0f09ffd66
Opcode Fuzzy Hash: 358bf576e56decd8f2e7f90188ea1eefff155e9cbdee11c1dd08b084efa6ea4a
Instruction Fuzzy Hash: 8C014F76A05214AFC720DB9D9884ACAB7ECEB59320F9041A6F508EB341D7709D41C7A4

Function 00B1B18E Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 00B1B1EA

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0c69140d9d37e8d12476f1714a0e3da4f894065d0a7fb311409a74fd4bd2e766
Instruction ID: 0734034f163c89abbfd6d30daa01ff5cca3473fd5784e5c8a074fe7affb5962d
Opcode Fuzzy Hash: 0c69140d9d37e8d12476f1714a0e3da4f894065d0a7fb311409a74fd4bd2e766
Instruction Fuzzy Hash: 22F0AF76B04214BFC720CA9DAC84EDAB7ECEB49320F9041A6F908E7380D770DD8187A4

Function 00C5BE64 Relevance: 1.5, APIs: 1, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00C5BE84

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000C5B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c5b000_rutserv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cb7d296a45ca4d03d5673869a39be6bf716902801033117cdfc206ba527e85e4
Instruction ID: c54b9e052dcea587a4dd7e47a586ee19a2317fedb1f4093f60b181b7c428ae5d
Opcode Fuzzy Hash: cb7d296a45ca4d03d5673869a39be6bf716902801033117cdfc206ba527e85e4
Instruction Fuzzy Hash: 4AF058645012809BDB20EBB4D4D679A2BD69F85309F0C80CAE8984E357C7A2ADC8D322

Function 00B1B734 Relevance: 1.5, APIs: 1, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysReAllocStringLen.OLEAUT32(?,?,?,00B1AE29), ref: 00B1B74E

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction ID: 03f4227ee41ea208abdbb79dbd34501e440feb044578c70d96712d8d5d9f1d1c
Opcode Fuzzy Hash: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction Fuzzy Hash: 92E012B4500301DEEA249A149955EBB36EDEBD2302FE9C5DCA4219B244DB359CC0D778

Function 00C5BF2A Relevance: 1.5, APIs: 1, Instructions: 19
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadPriority.KERNELBASE(?), ref: 00C5BF41

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000C5B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c5b000_rutserv.jbxd

Similarity

API ID: PriorityThread
String ID:
API String ID: 2383925036-0
Opcode ID: 1804b150487d566257c4a539f8fab5237cca69a1f2fc754c77617693a8efd8d8
Instruction ID: 5c2c9c2798e3ee5189f5fe75aef81859873d1d67bf9e32f593d0779066a102c8
Opcode Fuzzy Hash: 1804b150487d566257c4a539f8fab5237cca69a1f2fc754c77617693a8efd8d8
Instruction Fuzzy Hash: E9D022777004291F8328EAFDA880CAE62CDCB8C2163008423F048C3318D225CC4943A4

Function 01021218 Relevance: 1.5, APIs: 1, Instructions: 18
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000401,?,00000000), ref: 01021230

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001021000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1021000_rutserv.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction ID: 05a578d2de7cb1b4dc0dde5afb4cf57f7adb1fd8aaf756ae963fc41882e59490
Opcode Fuzzy Hash: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction Fuzzy Hash: ECD05EB12002006FF700A6A9D8CAF6177DCEB45714F4940A0FF0C8F293C1B1AC408364

Function 00B1B498 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocStringLen.OLEAUT32(?,00000000,?,00B1B5F3), ref: 00B1B4A3

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction ID: 2f5b6446764140a90a39fb2783ce2f3e6460cee0d1936569c76a20863f622445
Opcode Fuzzy Hash: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction Fuzzy Hash: 06C0127814570199EA152B3059059BA17DCED953017D000D9B91085101E635D4D01564

Function 00B1B208 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 00B1B21D

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000B19000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b19000_rutserv.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 842a97c99812e5ca0e82c56dba980c36002d82f2aaaccd4a032a2104f68630b0
Instruction ID: 71dc9ff393d6fc1844779c15e4f0b6648f5b76d09a8390a0332ce7c7857f73af
Opcode Fuzzy Hash: 842a97c99812e5ca0e82c56dba980c36002d82f2aaaccd4a032a2104f68630b0
Instruction Fuzzy Hash: 9AC04C656412018BC22026B4A98864975A85748211FD4146462078B146C77844858758

Function 00FF859C Relevance: 1.4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IdThread (unknown), xrefs: 00FF85B5

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000FF8000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ff8000_rutserv.jbxd

Similarity

API ID:
String ID: IdThread (unknown)
API String ID: 0-2043411369
Opcode ID: 3a29a051106d279efc3729479d48e12d141e8987f06ddb1f9a877024af7b4140
Instruction ID: 7894a189c6719e6d40f86a7d3cab724347da302983e3fa129d2839cd08a036cf
Opcode Fuzzy Hash: 3a29a051106d279efc3729479d48e12d141e8987f06ddb1f9a877024af7b4140
Instruction Fuzzy Hash: AB418D31604648EFD712DF24C995A69BBF5FF0A790B6244A0F900E7A71CB34EE12FA51

Function 0101C710 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

loopback, xrefs: 0101C7D0

Memory Dump Source

Source File: 00000011.00000002.3309111611.000000000101C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0101C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_101c000_rutserv.jbxd

Similarity

API ID:
String ID: loopback
API String ID: 0-3546420730
Opcode ID: 63c5056ddbe7927af64efa15b84716879da959a1138d3b5b18da165b30984279
Instruction ID: 43f715fde8778e5b8981ec455282044374b973e7bbaf97c3227219c4efcf2a26
Opcode Fuzzy Hash: 63c5056ddbe7927af64efa15b84716879da959a1138d3b5b18da165b30984279
Instruction Fuzzy Hash: 14411474A40208AFEB01EFA8D991D9EBBF8FF49310F6085A5E854E7665D734EE40CB50

Function 01A167B0 Relevance: 1.3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TProcessMessagesThread.Execute, xrefs: 01A167BE

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001A16000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01A16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1a16000_rutserv.jbxd

Similarity

API ID:
String ID: TProcessMessagesThread.Execute
API String ID: 0-3632000192
Opcode ID: 23d8020197c2a155c171dee5379c405318bf06d4c3b508c2f5443db70442907b
Instruction ID: f5fba26a69de90f3a2518c03838184a98ec64ee881330e70ce431f47621b0c40
Opcode Fuzzy Hash: 23d8020197c2a155c171dee5379c405318bf06d4c3b508c2f5443db70442907b
Instruction Fuzzy Hash: E8215974A04205EFD700EF69D981A89B7F6FB49324F2082A5F828DB3A5C771ED40DB90

Function 00DF3DE0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000DF3000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00DF3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_df3000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47532edffdc485e4fda10b4afa671e5e902900c840d4e64dd7be96981f1d220f
Instruction ID: 36e3947c8b4f4d0c78ee363cd4cec3a4eba5e366dd2746c6bb91a5f516f7f2c3
Opcode Fuzzy Hash: 47532edffdc485e4fda10b4afa671e5e902900c840d4e64dd7be96981f1d220f
Instruction Fuzzy Hash: BF413930A0424CEFDB11DBA4D846BAD7BF5EF08310F6785A9E90897291D7B09E84CB61

Function 00DF3000 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000DF3000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00DF3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_df3000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97157b03a8e4c0f99a91fa3656d51235fd433b626bbec081894fcfb084bc6e00
Instruction ID: 947f1ba434e611d68ebadbea5f4c7348b84a5cf4ec83205c8222c43c47333ab8
Opcode Fuzzy Hash: 97157b03a8e4c0f99a91fa3656d51235fd433b626bbec081894fcfb084bc6e00
Instruction Fuzzy Hash: C2417034A04288EFDB05DF68D891AADB7F6EB49300F2685E6E915DB352C7309E41DB20

Function 01340A74 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001340000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1340000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cab3d4c3fe4f794fe07671c72c153b92f6fede23f0978f519e548e8880f0667
Instruction ID: 3825e4205a15ce062d61862d12663c304c7e3ee00209b0b1fbdb03f98c437e77
Opcode Fuzzy Hash: 6cab3d4c3fe4f794fe07671c72c153b92f6fede23f0978f519e548e8880f0667
Instruction Fuzzy Hash: 23314835704204EFE719CF68D855FA9BBF5EB49718F6244E5F90497751D730AE00CA24

Function 00DF3DDE Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000DF3000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00DF3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_df3000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0099e7bdef5e14c992019bb7552e8d5bb65ad29f4443944764678beb9faf764
Instruction ID: 0272e22f292fce7c5fb0122423440e1b8f4dea9081bca41f2e16d051465390ef
Opcode Fuzzy Hash: d0099e7bdef5e14c992019bb7552e8d5bb65ad29f4443944764678beb9faf764
Instruction Fuzzy Hash: F4316B30A0824CEFDB11DBA4D846AAEB7F5EF04310F6785B5E90497252D7B09F44CB60

Function 01340E78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001340000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1340000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea9727751d4f872909cc4743219183cac13db417bce50cdcc7f952d3428fe94
Instruction ID: e8693b44ef0ba4c1064db17c7341233512f99659e1a5561efe0de4842c876bbe
Opcode Fuzzy Hash: dea9727751d4f872909cc4743219183cac13db417bce50cdcc7f952d3428fe94
Instruction Fuzzy Hash: 34211F38704208EFCB00DFA8C484D99B7F4EF49314B2181E5E905DB322DB31AD46CB41

Function 01340D60 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001340000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1340000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e2c3d130acde5bded5d3daca8e46a3604efea4ccbb71ff0e66625491e0cd13
Instruction ID: beadff42d72c88798e3b917359085f23c6298362b88e61bf191673e96e8a7022
Opcode Fuzzy Hash: c3e2c3d130acde5bded5d3daca8e46a3604efea4ccbb71ff0e66625491e0cd13
Instruction Fuzzy Hash: A7114C30344A418FD768EB3C8550BDABBE5AF8A388F044469FAC9DB312C731B849C791

Function 00FF8D2C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000FF8000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ff8000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction ID: e06d179c69d90d96f6a63339a3dca7a05f1e867e723b0bc926ebf86696e1e1a2
Opcode Fuzzy Hash: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction Fuzzy Hash: A6E02273B005881BC210E25E6C81FEAB789DFC57F0F0C0131FA08CB381D9234C4692A6

Function 00DF3EF5 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000DF3000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00DF3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_df3000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34f78ad39925a6676321144dd707be3535d0a92881bc57d46e3a37415dc79d0
Instruction ID: 9b74424308de2a8059daab5496dbc5c880053b1bf2652765c2de84868ac80696
Opcode Fuzzy Hash: e34f78ad39925a6676321144dd707be3535d0a92881bc57d46e3a37415dc79d0
Instruction Fuzzy Hash: 66F0A030E08148EADB05E7B0E102BAEB7F19F40310F7688E5E80593282DA70DE858271

Function 01340E1A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001340000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1340000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b182f17f5041c68340af387088dce2e8861de485bfd3c682642c1130410258
Instruction ID: 380b9c3a22369b755b1578df5d56c6bfb43df9b0cf5e980b08acd75da10de358
Opcode Fuzzy Hash: 39b182f17f5041c68340af387088dce2e8861de485bfd3c682642c1130410258
Instruction Fuzzy Hash: C8E0DF60300B611BE73424BC49C0BF711C88B00B1CF080578BB4DC9202CAAAEED44311

Function 00F8CF30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000F8C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00F8C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88722f0aa4043ea1fa5bcbd1a3398404f825a527383b20617729ee4bdc960dc
Instruction ID: ded835d3bdf1a0fd1788ff675e9057958a693e43c907f87e67355d843c6385c3
Opcode Fuzzy Hash: b88722f0aa4043ea1fa5bcbd1a3398404f825a527383b20617729ee4bdc960dc
Instruction Fuzzy Hash: F5B092A225C2107CB91E22526D83CBA32E9D9C1B11B2288DEF54084CD0AFD11880E2B2

Function 00F8CF18 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000F8C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00F8C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f98b2d89f476d17049841888ab8cf2396c07ce972ec4a082dd0b62700f699c7
Instruction ID: 5ebcef3cb0703229807294a4d87ee7ed1fc74ca6bacedaad8e15d5004c6ffab1
Opcode Fuzzy Hash: 8f98b2d89f476d17049841888ab8cf2396c07ce972ec4a082dd0b62700f699c7
Instruction Fuzzy Hash: 0AB09BA125C2107C751D22515D43CB531D9C9C1B11B1184DDF54444C905FD11441F171

Function 01340E64 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001340000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1340000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction ID: fcb5369b2dbd4e4244ba5b45ad8b47640ea6ed1b3b5c9e8b0c3064dbadbdda93
Opcode Fuzzy Hash: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction Fuzzy Hash: CDC09270700204CFDB58FF7CC9C9A823BF4AB4820971480A0AA09CB2ABE7B0DC94CB40

Function 00F8CF03 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000F8C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00F8C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77a0732d3c6e774228ccf4221bca692c8db2d128e9db62c622b5d33abdb225c
Instruction ID: 4d4a8fe26a39dbb354d604f4ffcb6647fed5d8dfd2576f5db8b1e3e1a5c8f549
Opcode Fuzzy Hash: b77a0732d3c6e774228ccf4221bca692c8db2d128e9db62c622b5d33abdb225c
Instruction Fuzzy Hash: 99B0922120D3D01DD62F23A029A24A83BE08C83210B1A04DAE4C08A5A29E411082D252

Function 00FF8C84 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000FF8000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ff8000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction ID: adee8880be86d578d1361a82603c8237f1c7a8acd9e0851c3ce4e35af612179e
Opcode Fuzzy Hash: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction Fuzzy Hash: 58B0923600020C7A8A012AC5D8018497B19AB50260B408011B90808022A632A6A4B698

Function 00C59AAA Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000C59000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c59000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction ID: dcab931c4a539a2eadd99cff47283e157d11fd23f3196920210e5ae52d992c9a
Opcode Fuzzy Hash: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction Fuzzy Hash: 6BB001747001158F9F80DB28C688905B7E1BF8932131583E0A409CB336DA30EC85CF81

Function 00FF9BBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000FF8000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ff8000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction ID: ec8c630dbb8dcb916fa40d63340fcb9b6b6c7c15d6c7aa9d2505734567ee7d94
Opcode Fuzzy Hash: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction Fuzzy Hash: 54A0113020800A8E8A00BB20C80A820F3A0BE003083A000E0A0880A0228B2AA800CB80

Non-executed Functions

Function 0101C8E8 Relevance: 15.2, Strings: 12, Instructions: 159COMMON

Download Yara Rule

Strings

font-size: 100%;, xrefs: 0101C94A
font-family: Courier New, monospace;, xrefs: 0101C940
font-size: 130%;, xrefs: 0101C972
body {, xrefs: 0101C936
margin: 0px 0px 0px 0px;, xrefs: 0101C97C
display: none;, xrefs: 0101C99A
<style type="text/css">, xrefs: 0101C92C
textarea {, xrefs: 0101C990
background-color: #FFFFFF;, xrefs: 0101C954
</title>, xrefs: 0101C922
h1 {, xrefs: 0101C968
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na, xrefs: 0101C90F

Memory Dump Source

Source File: 00000011.00000002.3309111611.000000000101C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0101C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_101c000_rutserv.jbxd

Similarity

API ID:
String ID: </title>$<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na$<style type="text/css">$background-color: #FFFFFF;$body {$display: none;$font-family: Courier New, monospace;$font-size: 100%;$font-size: 130%;$h1 {$margin: 0px 0px 0px 0px;$textarea {
API String ID: 0-3743830688
Opcode ID: 7771e5f21586e27c3c58cf2cb974dff15bd3062b03331c6c646dd447aaed38db
Instruction ID: e9894869c550396121f2171ca85b6794fec6eac086109b4d59f00795884da224
Opcode Fuzzy Hash: 7771e5f21586e27c3c58cf2cb974dff15bd3062b03331c6c646dd447aaed38db
Instruction Fuzzy Hash: 03414120BC8340BEB20175D39F4BEA76FB1A3A8E55F80455CB0D6BD98F95EDE5105208

Function 01A1615C Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

closed_by_user, xrefs: 01A161F6
show_duration_in_sec, xrefs: 01A16264
ra_session_id, xrefs: 01A161B4
network_load, xrefs: 01A1629B
error_code, xrefs: 01A1622D

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000001A16000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01A16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1a16000_rutserv.jbxd

Similarity

API ID:
String ID: closed_by_user$error_code$network_load$ra_session_id$show_duration_in_sec
API String ID: 0-946321287
Opcode ID: 562e3baa56fe4268ceba09880e787c2d7c03868ce29d3a9e66d7ebb9f9a13df5
Instruction ID: 06464dbe64cffce7df563c7ea55af747890a585d254a26df8bdf2fd8ffc13ff3
Opcode Fuzzy Hash: 562e3baa56fe4268ceba09880e787c2d7c03868ce29d3a9e66d7ebb9f9a13df5
Instruction Fuzzy Hash: CC61E534A10209DFCB44EFA8C5859DDBBF5FF49304F6044A9E805AB266DB70AE4ACF51

Function 00C59594 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

INHERITED, xrefs: 00C595A8, 00C59621
END, xrefs: 00C59601, 00C5965A
OBJECT, xrefs: 00C595D2, 00C59611
INLINE, xrefs: 00C595BC, 00C59631

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000C59000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c59000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 324297a30e272204d8d61b688e81ab215db4f381aefa5cbcb27b7149666a29a6
Instruction ID: 607a9baf09172dda785db6abc157b5b0211b42ba631435ca4ebba8ab01adb726
Opcode Fuzzy Hash: 324297a30e272204d8d61b688e81ab215db4f381aefa5cbcb27b7149666a29a6
Instruction Fuzzy Hash: 1921666C208204CBCF10EF6CD481A9AB3D2DF59356B648594FC848B346CE36D9CE9B6C

Function 00C59593 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

INHERITED, xrefs: 00C595A8, 00C59621
END, xrefs: 00C59601, 00C5965A
OBJECT, xrefs: 00C59611
INLINE, xrefs: 00C59631

Memory Dump Source

Source File: 00000011.00000002.3309111611.0000000000C59000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c59000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: eb18538b5bdfc9580446b551f1ba7937693af74c71a982e8835b64e4b058cf31
Instruction ID: af93ceafdab0245813e779916363aa6bb16cf4d65d515c4ed8c56415681c5f89
Opcode Fuzzy Hash: eb18538b5bdfc9580446b551f1ba7937693af74c71a982e8835b64e4b058cf31
Instruction Fuzzy Hash: EA11596C208100CBDF10EF6CD88169AB3D2DF59356B648294FC945B346CE32D9CE9B58

Analysis Process: rfusclient.exePID: 7956, Parent PID: 7864COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	2

Executed Functions

Function 014AB6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(\\.\PIPE\RManFUSServerNotify32,40000000,00000003,00000000,00000003,00000000,00000000,00000000,014AB75A), ref: 014AB6ED
CloseHandle.KERNELBASE(000000FF,014AB761), ref: 014AB752

Strings

Error - NotifyServer - WriteFile, xrefs: 014AB737
\\.\PIPE\RManFUSServerNotify32, xrefs: 014AB6E8
Error - CreateFile, xrefs: 014AB6FB

Memory Dump Source

Source File: 00000013.00000002.3296607426.00000000014AB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 014AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_14ab000_rfusclient.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: Error - CreateFile$Error - NotifyServer - WriteFile$\\.\PIPE\RManFUSServerNotify32
API String ID: 3498533004-2744967546
Opcode ID: 1c06f164e7bfac941265f978309c8c30b659cdc108b452f25464e87775c84d1e
Instruction ID: b134e59efadaca5ef201a66e1b09eafc3c69030c1df1caae61c1a17242112cc1
Opcode Fuzzy Hash: 1c06f164e7bfac941265f978309c8c30b659cdc108b452f25464e87775c84d1e
Instruction Fuzzy Hash: 70110478A40304BFE711EBF9DC02B5D7BB8EB58710FA24566FA10D72E0D6B05A009B25

Function 00C7AF00 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 00C7AF5A

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000C7A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c7a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 95578fd014d7839bc5151dcbd12c607cbbd543ec206d5883973568f93e61ffeb
Instruction ID: c6c1a9bc3ca728e62cab5351cd93ad2d99c5a5d9e0363cb126c38831fcb8ada0
Opcode Fuzzy Hash: 95578fd014d7839bc5151dcbd12c607cbbd543ec206d5883973568f93e61ffeb
Instruction Fuzzy Hash: 56018FB2A05214AFCB11DEDDA880A8EB7ECAB48361F10C026F91CDB381D6719D0187A1

Function 00C7AEFE Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 00C7AF5A

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000C7A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c7a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: df2ca43f99ab5eb04f711263cfb11bc25c89e91abdcbbb6086b7acc7e0b1ada0
Instruction ID: 0fac4eaff1fdfffd52fe898a58d95f154bc80a9bcd5d4c67019ff20b5db04f45
Opcode Fuzzy Hash: df2ca43f99ab5eb04f711263cfb11bc25c89e91abdcbbb6086b7acc7e0b1ada0
Instruction Fuzzy Hash: 1BF0C2B2B05214AFCB11DADDAC80A9EB7ECDB48361F108026F91CD7381D771DD0187A4

Function 00C7AF78 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 00C7AF8D

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000C7A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_c7a000_rfusclient.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 65cf1ab015ee73eaf2a80b3c78a7a4f5977744a29164e6774c9c7dced1944c96
Instruction ID: 7490f4f1bcf81b8c2ebbcad54935b474ea39e3870a4ea77307b2f2f5d736a4ab
Opcode Fuzzy Hash: 65cf1ab015ee73eaf2a80b3c78a7a4f5977744a29164e6774c9c7dced1944c96
Instruction Fuzzy Hash: 5AC048E12027008BCB36ABB9A88871A62A86788202F059828F50B96177C7BC9884D710

Function 014AB75F Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(000000FF,014AB761), ref: 014AB752

Memory Dump Source

Source File: 00000013.00000002.3296607426.00000000014AB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 014AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_14ab000_rfusclient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction ID: c187e7d9c697131c4c5c61678a668a029bb613a6096a4357771017da8262d57a
Opcode Fuzzy Hash: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction Fuzzy Hash: 76A0222A808203FE8A00F3E0880282C23388A0C2A8BB80C02F203C2000C238AE00A338

Function 00DB3DBC Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000DB3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00DB3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_db3000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd75a94553d92c3417ebdb905a42fe36447683c7a96bf5eb51d4f5fc775c79db
Instruction ID: 8c96232b1f800000c04e22a46d561b25e45e7cdf24e90b33959c415cd209d42e
Opcode Fuzzy Hash: dd75a94553d92c3417ebdb905a42fe36447683c7a96bf5eb51d4f5fc775c79db
Instruction Fuzzy Hash: 5531B670904744EED721EBB588417EB7BE59F49300F04C92EF4AADB281D730EA44E765

Function 00DB3C26 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000DB3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00DB3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_db3000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3912ba4ae31d0636156d32b9cfc79047ab653e1b4539ebe6f5ad5533f7c6b4a8
Instruction ID: 3261f7dad094bf204fbd32c71bb7b361ca882157ae67d0f4427e864669973f8d
Opcode Fuzzy Hash: 3912ba4ae31d0636156d32b9cfc79047ab653e1b4539ebe6f5ad5533f7c6b4a8
Instruction Fuzzy Hash: 5B118B70608644EFD701DFA9C9199ADBBF8EB4A710B6284E0F801A7712C730AE00EA60

Function 00DB3C28 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000DB3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00DB3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_db3000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31454a926e9c3c53e96a7856cd69ea000d7e8450514564469cc1379c47ccbeb0
Instruction ID: 3b9c565111446d8c4bf89462e304ff00d601a3199e3d723d7c2b614cedd9d72d
Opcode Fuzzy Hash: 31454a926e9c3c53e96a7856cd69ea000d7e8450514564469cc1379c47ccbeb0
Instruction Fuzzy Hash: 75119D70608644EFD701DFA5C91999DBBF8EF4A710F6284E0F801A7712C730AF00EA60

Function 00DB3D20 Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.0000000000DB3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00DB3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_db3000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction ID: a4743c0c6fbb62951f792c58f4587bbd65552351a794a23ff21e1c762ffee0c4
Opcode Fuzzy Hash: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction Fuzzy Hash: 44D05E5274292087D11463AD5D827E56659CF81AE2F0C8130B95ACB395EA168E1922F6

Function 010CBD5C Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.00000000010CB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 010CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10cb000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5157fc25c8b96b8477d59aa28ded9c214125e248d060ae81444e2a53f154019
Instruction ID: f8b122f00853f661586d78e289baac2877870714e143fabd7ff4574652550635
Opcode Fuzzy Hash: d5157fc25c8b96b8477d59aa28ded9c214125e248d060ae81444e2a53f154019
Instruction Fuzzy Hash: 8BB09BE155CA00EC650736525D87C7D5269D580E55F14411DF0414D041AD511441697A

Function 010CBD74 Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3296607426.00000000010CB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 010CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10cb000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271351877264c0f967eb4cd8ac850a9532f7db43233d3006a8554e66d9b58f6a
Instruction ID: 9a8583b5f40a157a97297cb9108cb814cfcf5c604fab5e8aa94ff614981d0201
Opcode Fuzzy Hash: 271351877264c0f967eb4cd8ac850a9532f7db43233d3006a8554e66d9b58f6a
Instruction Fuzzy Hash: EFB09BE155C600EC650736525C87C3D52A9E581E55F14411EF0414D041BD505440697A

Analysis Process: rfusclient.exePID: 7968, Parent PID: 7864COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	75
Total number of Limit Nodes:	3

Executed Functions

Function 00C797D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000000,?,00C79889,?,?,00C79AC8), ref: 00C79836

Strings

gfff, xrefs: 00C7981A
gfff, xrefs: 00C797F1

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000000C79000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C79000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_c79000_rfusclient.jbxd

Similarity

API ID: Sleep
String ID: gfff$gfff
API String ID: 3472027048-3084402119
Opcode ID: e7e8485e0fd0765abcc20c6a60cc348a46adec81a15d590179472883e54d1a3a
Instruction ID: 83140354efae8d6797218a03fb22dbb52e6a069f57c437d65e72c2f3992253aa
Opcode Fuzzy Hash: e7e8485e0fd0765abcc20c6a60cc348a46adec81a15d590179472883e54d1a3a
Instruction Fuzzy Hash: 510186717005118BDB6CAD3EA8917282697F783305F94C239E51ECE2CADAB59945A343

Function 00F2383C Relevance: 1.6, APIs: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 00F2392F

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000000F23000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F23000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_f23000_rfusclient.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction ID: 19d59b4667614b7676a981fd1d87dafd66da4631d437ac6b19b35f8239cc894c
Opcode Fuzzy Hash: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction Fuzzy Hash: 722141A1B4435036EA3135292C42BBE77874F93F64F144019F5819B182CAED9D46B326

Function 01155E68 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(01155F28,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,01155F1A), ref: 01155E9C

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000001155000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01155000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1155000_rfusclient.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e9f650c551bca76257a6e4f93197258e443578192141a3be08ffed509391d1ca
Instruction ID: 724e9c6f40b5dbe9099f2499569c5fde1e277c5509c669e355c0f9df8a918aea
Opcode Fuzzy Hash: e9f650c551bca76257a6e4f93197258e443578192141a3be08ffed509391d1ca
Instruction Fuzzy Hash: 0E110830644304FFE7A99BA8DC16F5CBBB4EB09B20F2145A5F930A66D0DB706940E616

Function 00F234A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 00F234D1

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000000F23000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F23000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_f23000_rfusclient.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction ID: 40d1e2d9202a7fb67f9b8fc2ea161c37f368e76495249c873059291dbc21a698
Opcode Fuzzy Hash: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction Fuzzy Hash: C2F030A57001201ADB13FA5894C9BEA27E89F85724F0C40F6FE0D9F247C7698E01A365

Function 01155EFD Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 01155F12

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000001155000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01155000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1155000_rfusclient.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 9e23a74572e9b4d06d1ca6d20aaac1a85e95e589ecff291dfe75491a171deba1
Instruction ID: aec7877008b78f138c3aa8242c0b729c7a544fe1d44a78357c780ffdb4a2a8a6
Opcode Fuzzy Hash: 9e23a74572e9b4d06d1ca6d20aaac1a85e95e589ecff291dfe75491a171deba1
Instruction Fuzzy Hash: B5C09B7224C141DFA349EB95B91345C77D1D7847603314C77F401C5551DB245D00953E

Function 01155F1F Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 01155F12

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000001155000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01155000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1155000_rfusclient.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 74d70c5535d973b0ccbeda4e5a098e924a55d675ccdf0dad7df82c4f5eeefdd4
Instruction ID: ea6692fae82d4931cc5355306cf587cdbc63c588e201a4fe0a49e2dc0ffb5b47
Opcode Fuzzy Hash: 74d70c5535d973b0ccbeda4e5a098e924a55d675ccdf0dad7df82c4f5eeefdd4
Instruction Fuzzy Hash: 4EA0022158A097FF8788F7A5D55349CB7629E087907394D62F493D5433CB24AE40A53B

Function 00F87F48 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000000F87000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F87000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_f87000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff4a9e3ef08ab09c00f06281effb68458011349d6b02c7450af61b9eff3111d
Instruction ID: 7171d1902b78f0c0d0ebb6054cef81d9df8056d00087b5133464f4ddd875cd83
Opcode Fuzzy Hash: 8ff4a9e3ef08ab09c00f06281effb68458011349d6b02c7450af61b9eff3111d
Instruction Fuzzy Hash: 98113734600304EFD711DF68C955F99BBF9EB0A740FA244E0F8049B662CB75AD15EB61

Function 00F878B8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3296052922.0000000000F87000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F87000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_f87000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction ID: a5e0f0e92e87f6f0ae1aa2f22597ad7a4eb5512e3184f87869af3e6815725d34
Opcode Fuzzy Hash: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction Fuzzy Hash: DDB0123600010CB78F017E81FC01C8A7F1DEB10360B00C015F9080812286339570ABB4

Input	Output
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": " ", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": "Got it", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": "Got it", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 442.docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4c8463.rbs

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Windows Analysis Report
442.docx.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre