Edit tour

Windows Analysis Report
442.docx.exe

Overview

General Information

Sample name:	442.docx.exe renamed because original name is a hash value
Original sample name:	.docx.exe
Analysis ID:	1567177
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
Infos:

Detection

RMSRemoteAdmin

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

AI detected suspicious sample

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

442.docx.exe (PID: 6236 cmdline: "C:\Users\user\Desktop\442.docx.exe" MD5: FB8117B1A3F0924100FBC209DBBB1BB1)

msiexec.exe (PID: 1544 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

WINWORD.EXE (PID: 3336 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

msiexec.exe (PID: 5856 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4960 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 27EB6A3C3744FE0C3070BA0974142203 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 7596 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi" MD5: CB9BE257064162076EBD4869CD97E166)

rutserv.exe (PID: 7732 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7876 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

sppsvc.exe (PID: 1704 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)

svchost.exe (PID: 5968 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rutserv.exe (PID: 8104 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rfusclient.exe (PID: 3688 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 7512 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 2416 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

rutserv.exe (PID: 2088 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39e594:$s1: rman_message 0x46d594:$s3: rms_host_ 0x46df4c:$s3: rms_host_ 0x82acb0:$s4: rman_av_capture_settings 0x877858:$s5: rman_registry_key 0x8778a4:$s5: rman_registry_key 0x543d6c:$s6: rms_system_information 0x2f1a18:$s7: _rms_log.txt 0x503238:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.3578843843.000000000348A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000002.3578746166.000000000351A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000013.00000002.3578843843.0000000003458000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000002.3578746166.00000000034F6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000013.00000002.3584056287.0000000004DC4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000013.00000002.3584056287.0000000004D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000011.00000003.2017043262.0000000005748000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 7596	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7732	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 8104	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.rfusclient.exe.f50000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
10.0.rfusclient.exe.f50000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\442.docx.exe", CommandLine: "C:\Users\user\Desktop\442.docx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\442.docx.exe, NewProcessName: C:\Users\user\Desktop\442.docx.exe, OriginalFileName: C:\Users\user\Desktop\442.docx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\442.docx.exe", ProcessId: 6236, ProcessName: 442.docx.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.90.147.125, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Initiated: true, ProcessId: 8104, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49871

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5968, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Remote Admin Backdoor Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T09:00:05.231772+0100	2849354	1	Malware Command and Control Activity Detected	192.168.2.4	49874	111.90.147.125	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC845A0 rmsEncInitSimpleEncryption,memcpy,memcpy,	10_2_5FC845A0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC83760 rmsEncEncryptData,	10_2_5FC83760
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC83D30 rmsEncRsaPrivateDecrypt,memcpy,memcpy,memcpy,	10_2_5FC83D30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC838C0 rmsEncDecryptData,	10_2_5FC838C0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC842D0 rmsEncRsaPrivateEncrypt,memcpy,memcpy,memcpy,	10_2_5FC842D0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC83AE0 rmsEncRsaPublicEncrypt,memcpy,	10_2_5FC83AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FC84000 rmsEncRsaPublicDecrypt,memcpy,memcpy,memcpy,	10_2_5FC84000

Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_99a46da1-f

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 10.2.rfusclient.exe.f50000.0.unpack

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 442.docx.exe, 00000000.00000000.1709867810.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmp, 442.docx.exe, 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99740BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6E99740BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E998B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6E998B190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E999FCA0 FindFirstFileExA,	0_2_00007FF6E999FCA0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	10_2_60046B90
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then sub esp, 1Ch	10_2_6004BEB0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	10_2_60046AD0

Source: winword.exe

Memory has grown: Private usage: 1MB later: 89MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2849354 - Severity 1 - ETPRO MALWARE Remote Admin Backdoor Related Activity : 192.168.2.4:49874 -> 111.90.147.125:80

Source: global traffic	TCP traffic: 192.168.2.4:49808 -> 95.213.205.83:5655
Source: global traffic	TCP traffic: 192.168.2.4:49809 -> 77.223.124.212:5655
Source: global traffic	TCP traffic: 192.168.2.4:49869 -> 111.90.147.125:55555
Source: global traffic	TCP traffic: 192.168.2.4:49872 -> 78.138.9.142:8080

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.124.212
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125

Source: global traffic

DNS traffic detected: DNS query: id72.internetid.ru

Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlmj
Source: rutserv.exe, 00000011.00000003.3368896076.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl3A
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl;
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlW
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlc
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl&
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2123815564.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: svchost.exe, 00000006.00000002.3419435266.000001E620C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000006.00000003.1769298498.000001E620EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: rfusclient.exe, 0000000A.00000000.1831381748.0000000000F9F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.1954449236.000000007B210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3612352313.0000000004250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.glob
Source: rutserv.exe, 00000011.00000003.2611527049.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45%j
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6N
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45http://crl.globalsign.com/codesigningrootr45.crl
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45wi
Source: rutserv.exe, 00000011.00000003.2012865832.0000000000C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020
Source: rutserv.exe, 00000011.00000003.2611527049.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2123815564.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: rutserv.exe, 00000011.00000003.2013813580.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr3http://crl.globalsign.com/root-r3.crl
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/;
Source: rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000002.3613496586.00000000044D0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3613496586.00000000045BF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/nsys.ru/pf
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/pf
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/rd
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/D
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: 442.docx.exe, 00000000.00000003.1734447762.000001AE83505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: rfusclient.exe, 0000000A.00000000.1831381748.0000000000F9F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.1954449236.000000007B210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2123815564.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade.ini
Source: rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade_beta.ini
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 0000000A.00000003.1857706686.0000000000D05000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 0000000A.00000000.1831381748.00000000017AB000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000003.1906989311.0000000004405000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000C.00000000.1872421176.00000000018A1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000F.00000003.1932196409.00000000043A5000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1986456632.0000000002585000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: rfusclient.exe, 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000C.00000002.1916978966.0000000060227000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000006.00000003.1769298498.000001E620EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: rutserv.exe, 00000010.00000002.2013146565.00000000601DF000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugsrg/bugs/):
Source: svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000006.00000003.1769298498.000001E620E82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE8744B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/
Source: rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/O
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2123815564.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.3368896076.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2013813580.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3573779688.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/about/privacy-policy.php
Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/buy/money-back-guarantee.php
Source: rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/installing-and-uninstalling/

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.0.rfusclient.exe.f50000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E996C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6E996C2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c2b90.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3053.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI31DA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c2b93.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c2b93.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI3053.tmp

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9981F20	0_2_00007FF6E9981F20
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E998CE88	0_2_00007FF6E998CE88
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9965E24	0_2_00007FF6E9965E24
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E998B190	0_2_00007FF6E998B190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997A4AC	0_2_00007FF6E997A4AC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9983484	0_2_00007FF6E9983484
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9974928	0_2_00007FF6E9974928
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E996F930	0_2_00007FF6E996F930
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9990754	0_2_00007FF6E9990754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99A5AF8	0_2_00007FF6E99A5AF8
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9971A48	0_2_00007FF6E9971A48
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9961AA4	0_2_00007FF6E9961AA4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9982AB0	0_2_00007FF6E9982AB0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E999FA94	0_2_00007FF6E999FA94
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9983964	0_2_00007FF6E9983964
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997C96C	0_2_00007FF6E997C96C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99989A0	0_2_00007FF6E99989A0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9998C1C	0_2_00007FF6E9998C1C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9975B60	0_2_00007FF6E9975B60
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9984B98	0_2_00007FF6E9984B98
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997BB90	0_2_00007FF6E997BB90
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997AF18	0_2_00007FF6E997AF18
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9988DF4	0_2_00007FF6E9988DF4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9990754	0_2_00007FF6E9990754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9982D58	0_2_00007FF6E9982D58
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99A2080	0_2_00007FF6E99A2080
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E996C2F0	0_2_00007FF6E996C2F0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E996A310	0_2_00007FF6E996A310
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997126C	0_2_00007FF6E997126C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9967288	0_2_00007FF6E9967288
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99821D0	0_2_00007FF6E99821D0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997F180	0_2_00007FF6E997F180
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E997B534	0_2_00007FF6E997B534
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99853F0	0_2_00007FF6E99853F0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99676C0	0_2_00007FF6E99676C0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99A2550	0_2_00007FF6E99A2550
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E999C838	0_2_00007FF6E999C838
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9964840	0_2_00007FF6E9964840
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_6002DC00	10_2_6002DC00
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_60035800	10_2_60035800
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_6002D620	10_2_6002D620
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_600EE260	10_2_600EE260
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_600C7080	10_2_600C7080
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_60035AE0	10_2_60035AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_5FD36850	10_2_5FD36850
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_6002CBD0	10_2_6002CBD0

Source: unires_vpd.dll.2.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: rutserv.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.2.dr	Static PE information: Resource name: MAD type: DOS executable (COM, 0x8C-variant)
Source: rfusclient.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unidrvui_rppd.dll0.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unires_vpd.dll0.2.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: libasset32.dll.2.dr	Static PE information: Number of sections : 19 > 10
Source: rutserv.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: libcodec32.dll.2.dr	Static PE information: Number of sections : 20 > 10

Source: unires_vpd.dll0.2.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll.2.dr	Static PE information: No import functions for PE file found

Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE87583000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE874A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE8752D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1721650604.000001AE875EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe

Source: 10.0.rfusclient.exe.f50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll0.2.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll.2.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal88.evad.winEXE@28/327@1/5

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E996B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6E996B6D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E9988624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF6E9988624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1fa8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1ec4
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$970
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$1fa8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$828
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1ee4
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$970
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$e68
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$e68
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1d58
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1dac
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e34

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF64FBDC7A7C0C60AC.TMP

Jump to behavior

Source: 442.docx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rfusclient.exe	String found in binary or memory: ENGINESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3"
Source: rfusclient.exe	String found in binary or memory: MODULESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules"
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Users\user\Desktop\442.docx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\442.docx.exe "C:\Users\user\Desktop\442.docx.exe"
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 27EB6A3C3744FE0C3070BA0974142203
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 27EB6A3C3744FE0C3070BA0974142203	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll

Source: C:\Users\user\Desktop\442.docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Doc.LNK.3.dr

LNK file: ..\..\..\..\..\..\..\intel\Doc.docx

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: 442.docx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 442.docx.exe

Static file information: File size 25141051 > 1048576

Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 442.docx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 10.2.rfusclient.exe.f50000.0.unpack

Source: C:\Users\user\Desktop\442.docx.exe

File created: C:\intel\__tmp_rar_sfx_access_check_3941062

Jump to behavior

Source: 442.docx.exe	Static PE information: section name: .didat
Source: 442.docx.exe	Static PE information: section name: _RDATA
Source: webmvorbisencoder.dll.2.dr	Static PE information: section name: _RDATA
Source: vp8encoder.dll.2.dr	Static PE information: section name: .rodata
Source: vp8decoder.dll.2.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.2.dr	Static PE information: section name: _RDATA
Source: libasset32.dll.2.dr	Static PE information: section name: /4
Source: libasset32.dll.2.dr	Static PE information: section name: /14
Source: libasset32.dll.2.dr	Static PE information: section name: /29
Source: libasset32.dll.2.dr	Static PE information: section name: /41
Source: libasset32.dll.2.dr	Static PE information: section name: /55
Source: libasset32.dll.2.dr	Static PE information: section name: /67
Source: libasset32.dll.2.dr	Static PE information: section name: /78
Source: libasset32.dll.2.dr	Static PE information: section name: /94
Source: libasset32.dll.2.dr	Static PE information: section name: /110
Source: libcodec32.dll.2.dr	Static PE information: section name: .rodata
Source: libcodec32.dll.2.dr	Static PE information: section name: /4
Source: libcodec32.dll.2.dr	Static PE information: section name: /14
Source: libcodec32.dll.2.dr	Static PE information: section name: /29
Source: libcodec32.dll.2.dr	Static PE information: section name: /41
Source: libcodec32.dll.2.dr	Static PE information: section name: /55
Source: libcodec32.dll.2.dr	Static PE information: section name: /67
Source: libcodec32.dll.2.dr	Static PE information: section name: /78
Source: libcodec32.dll.2.dr	Static PE information: section name: /94
Source: libcodec32.dll.2.dr	Static PE information: section name: /110
Source: eventmsg.dll.2.dr	Static PE information: section name: .didata
Source: vccorlib120.dll.2.dr	Static PE information: section name: minATL
Source: rutserv.exe.2.dr	Static PE information: section name: .didata
Source: rfusclient.exe.2.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.2.dr	Static PE information: section name: minATL

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99A5156 push rsi; retf	0_2_00007FF6E99A5157
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99A5166 push rsi; retf	0_2_00007FF6E99A5167
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 10_2_60047E30 push eax; mov dword ptr [esp], esi	10_2_60047ED1
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Code function: 17_2_013AC34B push ebx; ret	17_2_013AC354

Source: msvcr120.dll.2.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: VPDAgent.exe.2.dr	Static PE information: section name: .text entropy: 6.812931691200469

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3053.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3053.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.exe

Static PE information: 442.docx.exe

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer Security

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 0000000C.00000000.1872421176.00000000018A1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000C.00000002.1910189279.0000000002909000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.1994252538.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000010.00000002.1994252538.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEP
Source: rutserv.exe, 0000000C.00000002.1910189279.0000000002909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE
Source: rutserv.exe, 00000010.00000002.1994252538.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEEW

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Window / User API: threadDelayed 6288

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3053.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_10-6554

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

API coverage: 5.8 %

Source: C:\Windows\System32\svchost.exe TID: 6524	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6428	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8180	Thread sleep time: -50000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 4476	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 5796	Thread sleep count: 6288 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 5796	Thread sleep time: -62880s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7324	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 4476	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99740BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6E99740BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E998B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6E998B190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E999FCA0 FindFirstFileExA,	0_2_00007FF6E999FCA0

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E99916A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6E99916A4

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 50000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: rfusclient.exe, 0000000A.00000003.1856721971.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: svchost.exe, 00000006.00000002.3419540978.000001E620C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3418694570.000001E61B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3418719701.000001E61B843000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000011.00000003.2611527049.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E9993170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6E9993170

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E99A0D20 GetProcessHeap,

0_2_00007FF6E99A0D20

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9993170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E9993170
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9992510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6E9992510
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E9993354 SetUnhandledExceptionFilter,	0_2_00007FF6E9993354
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF6E99976D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E99976D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E998B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6E998B190

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior

Source: rfusclient.exe, 0000000A.00000000.1831381748.0000000000F9F000.00000020.00000001.01000000.0000000B.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E997DC70 cpuid

0_2_00007FF6E997DC70

Source: C:\Users\user\Desktop\442.docx.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF6E998A2CC

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E9990754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6E9990754

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF6E9974EB0 GetVersionExW,

0_2_00007FF6E9974EB0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: rutserv.exe, 0000000C.00000000.1872421176.00000000018A1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000C.00000002.1910189279.0000000002909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000010.00000002.1994252538.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Blob

Jump to behavior

Source: Yara match	File source: 10.0.rfusclient.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.3578843843.000000000348A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3578746166.000000000351A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3578843843.0000000003458000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3578746166.00000000034F6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3584056287.0000000004DC4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3584056287.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2017043262.0000000005748000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 8104, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	13 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	67 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	251 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	131 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	4%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	8%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	13%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	12%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI3053.tmp	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
main.internetid.ru	0%	Virustotal		Browse
id72.internetid.ru	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://rmansys.ru/rd	0%	Avira URL Cloud	safe
http://rmansys.ru/web-help/eb-help/D	0%	Avira URL Cloud	safe
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	0%	Avira URL Cloud	safe
http://rmansys.ru/pf	0%	Avira URL Cloud	safe
http://rmansys.ru/nsys.ru/pf	0%	Avira URL Cloud	safe
http://ocsp.glob	0%	Avira URL Cloud	safe
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
main.internetid.ru	95.213.205.83	true	false	0%, Virustotal, Browse	unknown
prod.globalsign.map.fastly.net	151.101.2.133	true	false		high
id72.internetid.ru	unknown	unknown	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://rmansys.ru///rmansys.ru/	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	rfusclient.exe, 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000C.00000002.1916978966.0000000060227000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://update.tektonit.ru/upgrade.ini	rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://update.tektonit.ru/upgrade_beta.ini	rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://madExcept.comU	rfusclient.exe, 0000000A.00000000.1831381748.0000000000F9F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.1954449236.000000007B210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	rfusclient.exe, 0000000A.00000000.1831381748.0000000000F9F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1872421176.0000000000EA1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000003.1954449236.000000007B210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/rd	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru/web-help/eb-help/	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3419435266.000001E620C00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.1769298498.000001E620EB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.microsoft.c	442.docx.exe, 00000000.00000003.1734447762.000001AE83505000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/pf	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	rfusclient.exe, 0000000A.00000003.1857706686.0000000000D05000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 0000000A.00000000.1831381748.00000000017AB000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000003.1906989311.0000000004405000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000C.00000000.1872421176.00000000018A1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000F.00000003.1932196409.00000000043A5000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1986456632.0000000002585000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://www.symauth.com/cps0(	442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/internet-id/	rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000011.00000002.3613496586.00000000044D0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000011.00000002.3613496586.00000000045BF000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/web-help/eb-help/D	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	rutserv.exe, 00000010.00000002.2013146565.00000000601C7000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000006.00000003.1769298498.000001E620E82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugsrg/bugs/):	rutserv.exe, 00000010.00000002.2013146565.00000000601DF000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://www.symauth.com/rpa00	442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/	rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru/	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access/	rutserv.exe, 00000011.00000002.3583938234.0000000002A2E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/nsys.ru/pf	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.flexerasoftware.com0	442.docx.exe, 00000000.00000003.1721650604.000001AE874DD000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1721650604.000001AE8751B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	442.docx.exe, 00000000.00000003.1721650604.000001AE8744B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000006.00000003.1769298498.000001E620ED2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/buy/money-back-guarantee.php	rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.remoteutilities.com/about/privacy-policy.php	rfusclient.exe, 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://ocsp.glob	rutserv.exe, 00000011.00000003.2012865832.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru///rmansys.ru/;	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/web-help/	rutserv.exe, 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.223.124.212	unknown	Russian Federation	51604	EKAT-ASRU	false
111.90.147.125	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
78.138.9.142	unknown	United Kingdom	8513	SKYVISIONGB	false
95.213.205.83	main.internetid.ru	Russian Federation	50340	SELECTEL-MSKRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567177
Start date and time:	2024-12-03 08:57:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	442.docx.exe renamed because original name is a hash value
Original Sample Name:	.docx.exe
Detection:	MAL
Classification:	mal88.evad.winEXE@28/327@1/5
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.28.47, 52.113.194.132, 23.218.208.109, 199.232.210.172, 52.111.252.15, 52.111.252.16, 52.111.252.18, 52.111.252.17, 20.42.65.90, 2.17.100.200, 2.17.100.210, 23.32.238.128, 23.32.238.98, 2.19.198.57, 23.32.238.105, 23.32.238.137, 2.19.198.59, 151.101.2.133
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, onedscolprdeus14.eastus.cloudapp.azure.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ocsp.globalsign.com, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod-all.naturallanguageeditorservice.osi.office.net.akadns.net, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, prod-inc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roam
Execution Graph export aborted for target rutserv.exe, PID 7732 because there are no executed function
Execution Graph export aborted for target rutserv.exe, PID 7908 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.213.205.83	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
main.internetid.ru	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
bg.microsoft.map.fastly.net	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	199.232.210.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172
	invoice-6483728493.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	PI-02911202409#.xla	Get hash	malicious	Unknown	Browse	199.232.210.172
	V-Mail.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
prod.globalsign.map.fastly.net	https://e.letscompress.online/update.txt	Get hash	malicious	Unknown	Browse	151.101.130.133
	http://propdfhub.com	Get hash	malicious	Unknown	Browse	151.101.130.133
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	151.101.194.133
	goJ2miRnrv.exe	Get hash	malicious	RMSRemoteAdmin	Browse	151.101.194.133
	goJ2miRnrv.exe	Get hash	malicious	RMSRemoteAdmin	Browse	151.101.66.133
	https://www.pdfriend.com/pdfconverter?gad_source=5&gclid=EAIaIQobChMIwqGhsbi9iAMVO6uOCB1oKCEPEAEYASAAEgJbhfD_BwE	Get hash	malicious	Unknown	Browse	151.101.2.133
	http://ak43423ce23ks.com/qnbfinans/	Get hash	malicious	Unknown	Browse	151.101.2.133
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	151.101.2.133
	https://firebasestorage.googleapis.com/v0/b/namo-426715.appspot.com/o/PqA45bE7me%2FForm_Ver-11-58-52.js?alt=media&token=dc88189e-81de-49e9-879e-365bc76e3567	Get hash	malicious	BruteRatel, Latrodectus	Browse	151.101.130.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYVISIONGB	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	83.229.59.112
	https://www.google.ml/url?fvg=1YI3fC8whlGPBCiMyiuQ&bhtBf=8EQhXbuMThqowIo0zyCX&sa=t&ndg=afydNw3nDHf9A6uq2MCH&url=amp%2Fiestpcanipaco.edu.pe%2F.r%2Fu1kOgE-SURELILYYWRhcnNoLm1hbGhvdHJhQGphdG8uY29t	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	arm4.elf	Get hash	malicious	Mirai	Browse	217.194.146.92
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	217.194.158.58
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	83.229.19.82
	https://bread.nfpt.adfixagency.co.in/	Get hash	malicious	Unknown	Browse	78.138.9.37
	https://bread1.nfpt.adfixagency.co.in/landingv2	Get hash	malicious	Unknown	Browse	78.138.9.37
	https://www.google.com/url?q=https://www.google.com/url?q%3DIrfT8NMLx6QPaJgv6Z3g%26rct%3DqsUbQmXhZ93d4gNXIWaR%26sa%3Dt%26esrc%3DEgJeLX8CAl11DNSW7pgH%26source%3D%26cd%3D9X3EYbyCMUoB46Jqpszn%26cad%3Dz64Ndl7J844jI5EH33et%26ved%3D36LRX1krI3rPMEZVSMU2%26uact%3D%2520%26url%3Damp%252Fsantanderconcepts%252Ecom%252F.lamb%252F&source=gmail&ust=1725986149001000&usg=AOvVaw1kdi6SPX1NGpGYFWhG_1Z7#NQvlKnUGFE-SURENICObWljaGFlbHNjb2ZpZWxkQGRpc25leS5jb20=	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	payload_x86.ps1	Get hash	malicious	Metasploit	Browse	83.229.120.79
EKAT-ASRU	loligang.mips.elf	Get hash	malicious	Mirai	Browse	5.165.233.70
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.166.34.53
	bin.sh.elf	Get hash	malicious	Mirai	Browse	85.115.185.36
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	77.223.100.3
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	77.223.100.3
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	5.166.34.83
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	85.115.161.24
	na.elf	Get hash	malicious	Mirai	Browse	5.166.34.78
	SecuriteInfo.com.Linux.Siggen.9999.28522.3483.elf	Get hash	malicious	Mirai	Browse	109.195.98.211
	SecuriteInfo.com.Riskware.OfferCore.11979.8662.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	188.234.81.249
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	101.99.75.104
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	111.90.149.151
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	111.90.141.53
	Ssc Executed Docs#962297(Revised).docx	Get hash	malicious	Unknown	Browse	111.90.146.230
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	101.99.125.192
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	124.217.225.17
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse

Created / dropped Files

C:\Config.Msi\3c2b92.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	33259
Entropy (8bit):	5.289849337500237
Encrypted:	false
SSDEEP:	768:H5t4t4t+ZXTWBwp1KwUXciM01HuECHgCg4gcgblFl6Y3TY3s8:KCBwpswUXceHuECHgCg4gcgblFlN3U3j
MD5:	7349A39DA4916878F9069FB5B32A41C9
SHA1:	BAADC465B7E4BA451ADEC1F9F4B9440003BD3781
SHA-256:	9B58ADCEB6B243F3B87351AE8F9140050A20EA8BEA87AC8A002F4445D36FE80B
SHA-512:	A31952C269684C627E3CE0421C52D11BF2B6C93D4DD506AA7257D86D06F279EC829208C987D6C47E742DD002AE889510E21681F2FA5195EC7B641C00C0B65138
Malicious:	false
Preview:	...@IXOS.@.....@V..Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.].....ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2...&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{3244CD

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	140524
Entropy (8bit):	4.705761523836363
Encrypted:	false
SSDEEP:	768:wu3K4JDvJNJt2cGTXxl5loUWDTEhkClEgoKt9ai1IYdO5NVSUeDfydxqXJe2JNC0:wu93dN2OqrYZlKhIiSEGQ4wL
MD5:	65B04B706AC06E31210F4FFB1E92994E
SHA1:	B005637B3DE903CBD7960637D77FF993897C5A63
SHA-256:	E9ACC22A02BC2148AE07EC7CBE741E6E1CBC90DE3856AAE8F32A31FB5C338566
SHA-512:	5B708D069434A384738EFD5F4621F257FC79A7F5A32D8AE9C1D29E21EFE1EEB2C393EC67DA39714C0C73F2217B68091EE7196C72331838A0A7ECA872FAF09A09
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0204

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.579534230870796
Encrypted:	false
SSDEEP:	192:XxgSABvdm4Yy3EA39QKoEp0Fm7qFAmL8x2fLWwsU7K6CYv7+C:Xx0FmW3Ea1KmexmMK6jr
MD5:	C2F009D6317D1BA4E722938A1408478A
SHA1:	66D702BC9FA98D1E7FE9BBC16AFF9AE711019E9B
SHA-256:	6A8D4FB6F90B53D986B2AC6BF3BFCC56D6A54A2E8AF5670129566F5D344ED0FA
SHA-512:	4D8060EC77EB9B95B57BC20AF2685064FA1E1FCC9403EFE95572C37D72ACD39B8005831EA0BAE95C365E945E50962B7FE1BFD964C5776D3E99CE5E474F726BFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: 044f.pdf.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......J....@.................................."..x....@..................@....P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2673984
Entropy (8bit):	6.865614554810881
Encrypted:	false
SSDEEP:	49152:BE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeF8:BE8XHX5riUl7wDP6vQ/qpyr0kR5XLWDB
MD5:	10CD2135C0C5D9D3E5A0A5B679F2FAAE
SHA1:	A0617D8C6876F98B9A1819A71F2A56B965C1C75D
SHA-256:	D7A97387505CA740AC88E85CAC3AA3CA73C666CC3BFD977C7E40B1D9D6CA6C12
SHA-512:	6A1F81127FF26DCC235D7CE454E69F9A3784AC54BBC8486CB5022AAC47C2FB6003641A0F8AAFDD3B89812FE3C1C90569AD73C1C135687C042CE92C5DD2FFBDD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L...h3.\............................5u............@.......................... ).......(...@.................................<.&.......'.H.............(.@.....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1110848
Entropy (8bit):	6.491478844569486
Encrypted:	false
SSDEEP:	24576:TqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzb:tQSX0oAtkpf/bfcyTTmoozb
MD5:	AB3E77FC94445A18C9376F98CE10102F
SHA1:	9424736FB3DB517C5584A14A482F84D81A671F8D
SHA-256:	EEE325D9AC6A7B24B8ED3742110BD042803D6DA065F2E51153151E69D51CE4A3
SHA-512:	454115C621434E98D39AEC605FCEB349C7AFB938B3E822F5950EE60E54FBFCB5CDBFE750015FE947C07FB991B4E966E535640343294D885ED2661353D3FD6EC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d.......................@........l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.464002114523214
Encrypted:	false
SSDEEP:	384:2+b57Gk7g+iy21oCiDuK9jkrtpgjKMpFmexmMK6j8qF2:7/210DuVrtsKM3ZxBKghF2
MD5:	2DE35EAAE57A6BAA02D9E8ED0661F042
SHA1:	82D14A58D5188F5B7606365BE0E3F968A8E81E93
SHA-256:	BB43036D202D3DBD765A12D1C4C243E7AB8328FFC1941AEA838D8B1553700E64
SHA-512:	02F1D530C1469431A94074A057FCE3FE60735D3B15DD767E8F39F29B702B98B061954063D83D5FA426D7684CC86359E87424F0CC54FFB0AC3F388AA7E48D6DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L...k3.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:..@....p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4005696
Entropy (8bit):	6.809616089473951
Encrypted:	false
SSDEEP:	98304:lbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FAK:FR+lDOt5kgFvVwmd
MD5:	2C5987EA1E87A5C073B780F8102AE09C
SHA1:	78DAA99D8C59A4A2E0D3B59E5427F854D8613080
SHA-256:	22AC34380064C0FFEE59AD892CA4695E94EE8F97B78C18565251295817A784FE
SHA-512:	7D6432960C5F3BEC27B13D06D4126C91A1DD7DD702DE97F1001855D8572BE68D6526F419BB58F5E5238E8E8F81C801BDAD8F351EF0AE75564835146F3DD3434D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.....3.=...@.........................pA:......p:.d.....;...............=.@.....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39744
Entropy (8bit):	6.36744082696392
Encrypted:	false
SSDEEP:	384:TkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQzUQ9LSk3E0gTSsn2TkhI3K0Jn:TLqokSaddQzUNk3EXSsn2Tk4ZZxBKgfP
MD5:	9ED8BAA9DEC76C6AFAFC1C71193A0AE8
SHA1:	843727F195BF194CFF3736B80FB5249713F1E116
SHA-256:	CD2C60402D46C339147ADDF110C904F78A783F23106CCAD147EFA156175D66DE
SHA-512:	40D85540176AB0170B7341D6A8A808FD351B35C6444D468E7707B35D2B2E8F3322DBF0BF31E0578E3A12E1A62B310DD7983B7EFB0F2C72D0C4104AEB0BBCEFF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L....3.\.................D...8.......I.......`....@.......................................@..................................s.......................\|..@............b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179520
Entropy (8bit):	5.239011393842513
Encrypted:	false
SSDEEP:	1536:+vQrKBVxKfGkHM5ZZ+HHJOWfuXO8zIJ1k9XHX8t0wk7UAjKQpmErUaDO3nG:3kjiTGD+JOWGT00XHXo0w+mErBO3G
MD5:	FF197487BFE7E9D3396E0793B83811ED
SHA1:	D92CA066B79DF28BF22BB051AEDFE10E4FA4A2A6
SHA-256:	E6D0CA844514FDD105772E72C7C30D47099112AB68A4A5F9E4A2B28C0372A05A
SHA-512:	33A13B0EE7E3DD038B35B5E4220278016397D003DCEECA56C3EE264608E053940AAFC09AE582C0FD67DFA919F38265883269F6C1A93E5BB9047B97F4A51CACCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L....3.\.................\..........8........p....@..........................0......T.....@.................................,5.......`..V...............@....... ....z..8...........................(...@............0..,............................text....[.......\.................. ..`.rdata...D...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53056
Entropy (8bit):	6.556803642202102
Encrypted:	false
SSDEEP:	768:AqfYixknAt1kJSwlxeZQHPFtuEK+XLxSzELK4ZHZxBKgCu:8ixknqaxxeZ09tVr7xkyZ5ncu
MD5:	A7A19BFD82EEAE7D4DC00144F3B949F4
SHA1:	FBD6EF10A7D519386CB32B093AE7E42852BAECBD
SHA-256:	A32A93B71A5628EDFC19FD31D26AC60DAF364E89CFDA2C82071718814042BE55
SHA-512:	5AC0F6A0FDAAB8B832B0021948101ABD1C8AF8B79E0C02D60770DF22D945D669AE7D588BD3264F9991E11CBAB01A445AAC9B594B47171C68A6A7BDC3FBB8D962
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L...j3.\.................v...:......Ez............@.................................Ul....@.................................t...x.......@...............@...............8..............................@...............\|............................text....u.......v.................. ..`.rdata... ......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772288
Entropy (8bit):	6.917291195041145
Encrypted:	false
SSDEEP:	49152:UuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChRebU:UuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpj
MD5:	9FD469846E628F44A4147743875FFBC0
SHA1:	6065C496D7C2695F3678D945FFA3FEFFBCD83C53
SHA-256:	129C2D91F085E54FD9E333C6F580A16907A1D9659D823D6C7CB25F5D3CE55CC8
SHA-512:	5AF5DD95BE604E039337D153CED2B9D3FE33F2E05818E3A222FDD9F7B3381197CCF3CA39324F46CA95B81DF76624F0EF4A0CF045195640E58B9A233D092F43AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... ....................................N....@.........................p.'..:..T.(.......)...............*.@.....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2991424
Entropy (8bit):	6.7900679594310915
Encrypted:	false
SSDEEP:	49152:kz1BQT/9rrcXgJoHt3LhNSTuHo6E7hVNO8B/3LUvQ/qpyr0kRZTKjEKMUP9isAxI:kz1BI5U3lNS6Ho6E7vBRIvQ/qpyr0kuF
MD5:	829DD10CD377386A2040897F5288DDB0
SHA1:	A7B1C7A6C0E1C9641750E8150EE810530FB67DD0
SHA-256:	5753F66DBC480901955DE247117F3C1E99777B1A610C90931E50C374F8B1D888
SHA-512:	C6B915EBF7B1C023FBB2E06FB169857539253CFA2B5B5C770DF5A43896AF8A0C847796E3F82C6109778F11D7FE3976DA172E1E0E6EACCD1C82DBAEB80ADAB4F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L....3.\..................!...........!......."...@...........................-.....;.....@...........................+.+.....+.......,.@.............-.@.....,..C...................................w+.@............."..............................text...g.!.......!................. ..`.rdata..$.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35648
Entropy (8bit):	6.365966080243848
Encrypted:	false
SSDEEP:	768:nE2YHORRn1SNBaiAL3X8jARHb2Os7fAK6ncZxBKg1xDo:E862HbPs7otEnzNo
MD5:	68EA0EC529B7B9D3284D860F5ABD9BB4
SHA1:	1A3951538D9E79F09792C8B118F010834A6C1273
SHA-256:	EE963C5960F6687789004175C3DF0098331BEBBCE992BF9C73EF9EF6ED73C1E0
SHA-512:	E62D2CFCA2433F4D647A5658141D63093D75491C60D1647F41FFDE74308BDF1A512DEBCC4A4535CE6FC9DE1ACB149D135D89366FE75FC9C52AA709C8887D7A28
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d....4.\.........." .....V..........\|P....................................................@..........................................d..W....[..................`....l..@........... ................................................................................text...'U.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204096
Entropy (8bit):	5.820956822859452
Encrypted:	false
SSDEEP:	3072:co2/UxSJBXgK5IsZsYMNV7jWCQQD9KdtvB1WOAahmRF:co284/XgGfbuYAKdf1WOAaO
MD5:	126C2BCC9112266CE33F9835A1E44B9C
SHA1:	B16C0D19797C7A0CC665BC8346ECF453234A83A4
SHA-256:	2736C2919966D17F27A34D69A7253CD4C2D09C6F7CF9FC03597F27BC73C0BDC2
SHA-512:	C25FC46CA2D8DAAD868FA2B5F1BA6CCAAC7F919C8C7CBB86952741B493D27E79EC8C7FD5F124A704B78F4197E6F3812D0FE0F64BC00117EE2AC09B41FAE85308
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d....4.\.........." .................~....................................................`..........................................G..l...\H..........(.......<.......@...............................................p............................................text...-........................... ..`.rdata..Z...........................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102208
Entropy (8bit):	6.071111727952987
Encrypted:	false
SSDEEP:	1536:8Fqz3IwGZjZ8lt0nt0NhuGO7o6LJ/TJhjYEOYULzEnr:MwYrZNQCnKhnOtthUEOYULzEr
MD5:	CC0E2455CFF19B3585C9FA781428E88E
SHA1:	93EC9326F0CEE4E7F385525B03DDF0DF89A409E8
SHA-256:	AF24B7E339CC6B80ECF7B45050533E8227D6491EED2FD8C3FF2BF22406B027AA
SHA-512:	B995CD999B36B9BD3DC8BE60A7576701CB91D18DF21934521C578047CD135C91F1027058198B1867A4D46804C0514523B370ECEC0E6691A041189011E31166A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...)4.\.........."............................@....................................R.....`..................................................[..........x............p..@...............8............................7..p...............P............................text...=........................... ..`.rdata...g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487232
Entropy (8bit):	6.340203111317007
Encrypted:	false
SSDEEP:	6144:MgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvr:MglSTPaRxFdLXyJ/ebEEkx0rqJduJ
MD5:	AD6C433A57BE03EE0C75076D6FE99CD5
SHA1:	219EE785F2C8127DAA44B298B5B2B096FCCE8D12
SHA-256:	8A180D92A2C879A3384D24A38EC8C9FD6BFD183935E61DA0B97F1C67A7EC9EA7
SHA-512:	041FB9165068D0EA879632B883B3E247336A3BB159ED46AE053B60D074A0BB231FA2DEEDD6CB2BA17AACB771413A86A3F970480AF7A2311E51702288D3B9A30E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t.....................................b....@..........................................4..........x....p.......@...(...P..@............!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892224
Entropy (8bit):	6.044434154548935
Encrypted:	false
SSDEEP:	12288:qpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so2:kZ5F/bYogxJUB9cwtHFMDp
MD5:	BB98224B0CB6F17D61AA24D7A46A08C5
SHA1:	DB78D1161EAA0C691DF76D1B6D7CC98793007BCE
SHA-256:	23A30F94360D710BB020DF76E7846AB991EDD6CA3C7F685AECF6CD1A019D451A
SHA-512:	D74291E8556911B77588D63EB20DB5D6642C31FEDD9EE186AE62D53C705F0CDBE14725ECBB8FC5FE770F45DFF05731EEBB2063A33BB78DF70B73CDCF4E86C465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................O.....@........................................../..{.... .................../...~..@...........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.630939020655746
Encrypted:	false
SSDEEP:	12288:+kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLd:SzBEGbL4Np84TQazCSiRd
MD5:	A0D2853BE8043F5FC4FEE04CFE5A8293
SHA1:	4FDF21E578739ABB4BCC938568F27897E733E229
SHA-256:	1D8C77B674F8294DB39B2CDE2873BDE5A2F6EBD65E14CAEEB58FBA94C92C1F3D
SHA-512:	FC5CE23DF55EF277D6DB898D5620697A3A061A5DD9BE63145CE71B966905CAC41B9785121709A2A0DCF8F90B76F484FAB619EB8DB40A873A867468ECF1620F99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0...............@............................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33600
Entropy (8bit):	6.281064018328684
Encrypted:	false
SSDEEP:	384:az2vV5RqtDcvnyQW7I+Ud26uiGKjzAVQjXzPishb8pe+7mNwSumexmMK6jcy:hgo7WcDGuB3Upe2m9uZxBKg3
MD5:	BED53AB8B9E406D1A8D6A85924E44282
SHA1:	19628BD3DE2BEF0EDC3622E4A7184162BD979040
SHA-256:	E5A10A74CFC36A4DCFCC9B25573B92A37B55062153EF9120B93154DB5792B3DA
SHA-512:	6F5C6945B0A982E8C94A826685158286D16173F51B10FDF1F5B9F4F93562240736A09B5F0997E995C0AF07360BACD51FA46CB8E4A3FA319519F3727FF87613E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...,4.\...........!.....F...........D.......`......................................a.....@.........................pU..W....M.......p...............d..@...........................................(...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159552
Entropy (8bit):	6.178643199247813
Encrypted:	false
SSDEEP:	3072:VYM7lLXShoSAJzKb9P+K61JJBsJgTcqTIbMNZ3mo+aGh1G:77tK+K61vBsJKcq0bMNZPXP
MD5:	F0A9D47D76E68883F04E60599EADAE6D
SHA1:	8F7BB6B9E9CB70529FA4C442ABF507A2F546E6E3
SHA-256:	2FAB0969C6E131834496428779A0809B97981F3E8D6FBF8A59632CB2DF783687
SHA-512:	18BBD1A3899C6B2F361BFA575D50D7DA29EAEF0E1C7CB50B318CECFE3150F268C1CDF30FEB5246B9F9B5D7FE36BD4A268E06595D9D3F3D86D933F14F5C43AD43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....3.\...........!.....L...N.......0.......`......................................k.....@.........................P...l...............(............P..@.......< ...................................z..@............`...............................text....J.......L.................. ..`.rdata...B...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..< ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87360
Entropy (8bit):	6.424955012685773
Encrypted:	false
SSDEEP:	1536:df1NQOOvFdve0e0ZIMhn9nA2LYK7ZOgkg6znnLnx9Inz1:/Adve07RnlhRN6znDQx
MD5:	66C5F108A058B515BBDDE628384990C9
SHA1:	0FBADFC5106056DFD269DF5EA532F69556CAE68F
SHA-256:	8D596D33CC3962B33B46D361BBC44A8088F18C09949734F3DEC54828372426AE
SHA-512:	6060EF07244385516989DF3AAD1C01E9F93B7B45A247D8D70FC5BE7A62BA96BFD22F80F0C78D178443D38796A2C7148CD3ADF4EB1A5FC430DFF5BB393492901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...$4.\.....................n....................@..........................p.......C....@.................................d........@..x............6..@....P..........8...........................P...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383296
Entropy (8bit):	6.650287803080611
Encrypted:	false
SSDEEP:	6144:yplBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lATI:O0/djgEUhWnJ2UlxqOttoICvPn/318Sm
MD5:	C3F39388BD4E6763F9734BC617388A17
SHA1:	AF5B4753F99C3F115294662876D7191DC8652786
SHA-256:	4D1F6A595889165B6A14B68D848C639748C9750C165BB4515CA3C3C67B4BA462
SHA-512:	BD8D00461E65F156686B0FC799926897845900F072F7AC10B66387E041CC7D3810ADBFB0137E9EA7B24995A11D324707D9E0FCD699D36E62ED089F46CC5ABA58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................Z!....@....................................x.......................@...............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	755520
Entropy (8bit):	6.198681499104638
Encrypted:	false
SSDEEP:	12288:IlIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxn:IvM36KkyCLW7QCwSGon
MD5:	0822EE0FF996BEB2B31EBBDD6449231B
SHA1:	7DF7F4978F3C4728CAEF9F95C6EB6C0D8CF8FDAC
SHA-256:	D727150FA7853748655E9CAA9F19F633E33BD191284703D6609984A64CB39CAB
SHA-512:	A47D25901FAD0507167E241350EC12C8D545F3F932E1B44E5F167A82263BCB97DA06B09454E8DE815EFC445088F2B1011028C3EAE5BF3F55FACAA3D9EC082815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p.....................................@.............................{....3.......p...............h..@....`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.629918098777896
Encrypted:	false
SSDEEP:	12288:tkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:LGBEGbL4Np84TQazCSiRC
MD5:	385152D096A96D1966C1042EDE38114F
SHA1:	A42D0587A2BF156C3F757778397A2E7AC8122E3C
SHA-256:	5A22FE5AF587540A9840E4F2A515564A2478DDA47AC1C81B687AC2F59C4C2FD0
SHA-512:	483E8819C6C5C1BCF725A4D6513364A5EE054E1D9100A8F42FFD2DBBFD52910CCA8E6DAF4435103C75AA2EBCA5A608BCC76EE6C531EA67C723267D9445D40256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@............................................................@............................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52312
Entropy (8bit):	6.450469916547452
Encrypted:	false
SSDEEP:	768:MsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYBZyIh9rOQ:Mza/pu/TKJ/OMpTryYzyMCQ
MD5:	4E84DF6558C385BC781CDDEA34C9FBA3
SHA1:	6D63D87C19C11BDBFA484A5835FFFFD7647296C8
SHA-256:	0526073F28A3B5999528BFA0E680D668922499124F783F02C52A3B25C367EF6D
SHA-512:	C35DA0744568BFFFEFF09E6590D059E91E5D380C5FEB3A0FBC5B19477CECA007A882884A7033345CE408FCE1DEAC5248AD9B046656478D734FE494B787F8A9F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...r.;`.....................$...................@..........................`....................................... ..q............P..................X....@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9223040
Entropy (8bit):	6.355581719432468
Encrypted:	false
SSDEEP:	196608:vL7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wbl3bc2EeJUO9WLcb0K:9lOJDm1Wrc2EeJUO9WLcbN
MD5:	8A9BDA9B9A84BD1551A09B65DFBC0C74
SHA1:	14FB48758D664917D789C21DCCB26D9D987F099F
SHA-256:	1D0F8C96F77C339A5F01822B9375131B0B0A49D6CAC45589CDB4B749DAA79773
SHA-512:	BBFB78B3652532E97F66E2DE7BFBEEFCB59254D9E626C62FF1B2E735AF2549B5483AB07739F6C9A686304C5042CDA79312028293959500BAC2A1EFE91B7732DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..f..i.t......!...*.~G...e..0............G...(m..........................j..........@... ......................Pc......`c.0"....c.............x..../....c............................`.S.....................\|ec..............................text....}G......~G.................`..`.data...,o....G..p....G.............@....rdata........H..0....G.............@..@/4...........0U......$U.............@..@.bss......... c..........................edata.......Pc.......c.............@..@.idata..0"...`c..$....c.............@....CRT....0.....c......8c.............@....tls..........c......:c.............@....rsrc.........c......<c.............@..@.reloc.......c......@c.............@..B/14..........`f.......e.............@..B/29..........pf.......e.............@..B/41......b...0h..d....g.............@..B/55...........h.......g.............@..B/67..........`i.......h.

C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7137640
Entropy (8bit):	6.481515443983134
Encrypted:	false
SSDEEP:	98304:ZRE7yGktThDyt6666666666666666666666666666666x666666666666666fww8:XGktThD0TGh/fTCRwlRvZG3XYBVX1
MD5:	0DF9039CE4896584A206A40F48A07C6A
SHA1:	34F0F9AEFD5E37B6B02D062B8AB967DC0F3D2F21
SHA-256:	1DDE27F0410E59561EAB79A6C8EF6DF2ACEC52E92C9AC646135CD91940F2BE05
SHA-512:	FCF74DD6BF3491D2E56A963ABF028EDA8DF17C11ABB793E6E3DAAD3C1E6C1AEE2F731B23CE243872B588CDF7B1B6382804F6B5204DFFC04F266BE3A329945FA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..f..T.i......!....(E..Q..:...........@E...0g..........................U.....7.m...@... ......................`P......pP.......P.............`.l../....P..#...........................FH......................rP.L............................text...`.E.......E.................`..`.rodata.@....0E......$E............. ..`.data...,(...@E..*....E.............@....rdata.......pE......XE.............@..@/4......L.....I.......H.............@..@.bss....X9... P..........................edata.......`P.......O.............@..@.idata.......pP.......O.............@....CRT....0.....P.......P.............@....tls..........P.......P.............@....rsrc.........P.......P.............@..@.reloc...#....P..$....P.............@..B/14...........Q......:Q.............@..B/29...........Q......BQ.............@..B/41......Y....S..Z....R.............@..B/55...........S......(S.

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11132168
Entropy (8bit):	6.740943395722077
Encrypted:	false
SSDEEP:	196608:kngOxqtJKXthIbi0EFrJIj35fGsX1bdXtK:kgOxqtQOUJ85jFhXQ
MD5:	CB9BE257064162076EBD4869CD97E166
SHA1:	49A8CACD48036784A413D63A242ED178BD75CBE9
SHA-256:	8A3822D52B4D460430B9E8E0FA6E6BD2C458598E4DBC2529DF7F2BDF902D2DD2
SHA-512:	013B7E7CCC77531C0D6FA81083B2F16CD0A2B2124105B2F855A478F1F114D3DBA75259B82596645E6BABD91E129E7F7F60AA85ECA32BD95F454B1A8A63B52EFB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................H...b#.....DW.......`....@.................................!....@......@..............................RX...@..\|................/.......v......................................................t........w...................text............................. ..`.itext...X.......Z................. ..`.data...\....`.......L..............@....bss....................................idata..RX.......Z.................@....didata..w.......x...4..............@....edata..............................@..@.tls....h................................rdata..]...........................@..@.reloc...v.......v..................@..B.rsrc...\|....@.......&..............@..@....................................@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21764872
Entropy (8bit):	6.6100525724973656
Encrypted:	false
SSDEEP:	393216:KEpVg+4nw7m2R8VLgZDMwyA7FWBdlY74ZV:tZR8VLg8AGYs
MD5:	D563A4D6BFCFE6884D1AC88824CB5C2A
SHA1:	710C0369915390737ED9BC19252F517D2D2939ED
SHA-256:	DE0FA71C1CFF03D657CB65A86072E964060C628AA4EB709CBE914DD772EF298D
SHA-512:	219D6307697CB12FA56020E6B2DC8FF5D13904FD318E2ED3646B294FAA1A613D838D0350E59B911023EA6F6D62CE53E402F975CAD4311D9A7DA58BD675AE2DB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................4....R.....<N.......P....@..........................`X.......L...@......@...............................b....!.8X7...........K../...0..`............................ ...............................p..:....................text............................... ..`.itext..`........................... ..`.data........P.......8..............@....bss.....................................idata...b.......d..................@....didata.:....p.......8..............@....edata..............................@..@.tls....h................................rdata..].... ......................@..@.reloc..`....0......................@..B.rsrc...8X7...!..Z7.................@..@..............G.......:.............@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388696
Entropy (8bit):	6.639766301981685
Encrypted:	false
SSDEEP:	6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
MD5:	E247666CDEA63DA5A95AEBC135908207
SHA1:	4642F6C3973C41B7D1C9A73111A26C2D7AC9C392
SHA-256:	B419ED0374E3789B4F83D4AF601F796D958E366562A0AAEA5D2F81E82ABDCF33
SHA-512:	06DA11E694D5229783CFB058DCD04D855A1D0758BEEAA97BCD886702A1502D0BF542E7890AA8F2E401BE36CCF70376B5C091A5D328BB1ABE738BC0798AB98A54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................A...............................@q.......q..........................X........(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640536
Entropy (8bit):	6.686577023894573
Encrypted:	false
SSDEEP:	49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
MD5:	D5C2A6AC30E76B7C9B55ADF1FE5C1E4A
SHA1:	3D841EB48D1A32B511611D4B9E6EED71E2C373EE
SHA-256:	11C7004851E6E6624158990DC8ABE3AA517BCAB708364D469589AD0CA3DBA428
SHA-512:	3C1C7FB535E779AC6C0D5AEF2D4E9239F1C27136468738A0BD8587F91B99365A38808BE31380BE98FD74063D266654A6AC2C2E88861A3FE314A95F1296699E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*..............................................5.......................................(............7..............X..............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265816
Entropy (8bit):	6.521007214956242
Encrypted:	false
SSDEEP:	3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
MD5:	49C51ACE274D7DB13CAA533880869A4A
SHA1:	B539ED2F1A15E2D4E5C933611D736E0C317B8313
SHA-256:	1D6407D7C7FFD2642EA7F97C86100514E8E44F58FF522475CB42BCC43A1B172B
SHA-512:	13440009E2F63078DCE466BF2FE54C60FEB6CEDEED6E9E6FC592189C50B0780543C936786B7051311089F39E9E3CCB67F705C54781C4CAE6D3A8007998BEFBF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0..............................................4...x.......................X......../..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373336
Entropy (8bit):	6.7704943019914845
Encrypted:	false
SSDEEP:	6144:faoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtOd:noPH0GgEp0gVd1ValsQXsHOd
MD5:	EDA07083AF5B6608CB5B7C305D787842
SHA1:	D1703C23522D285A3CCDAF7BA2EB837D40608867
SHA-256:	C4683EB09D65D692CA347C0C21F72B086BD2FAF733B13234F3A6B28444457D7D
SHA-512:	BE5879621D544C4E2C4B0A5DB3D93720623E89E841B2982C7F6C99BA58D30167E0DD591A12048ED045F19EC45877AA2EF631B301B903517EFFA17579C4B7C401
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b.....................................................@..........................M......@N..d.......0...............X.......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	880216
Entropy (8bit):	5.239371133407635
Encrypted:	false
SSDEEP:	12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN9S:YYF+Eyx2lzujtEIYRc1cQmsGa7ON9S
MD5:	642DC7E57F0C962B9DB4C8FB346BC5A7
SHA1:	ACEE24383B846F7D12521228D69135E5704546F6
SHA-256:	63B4B5DB4A96A8ABEC82B64034F482B433CD4168C960307AC5CC66D2FBF67EDE
SHA-512:	FB163A0CE4E3AD0B0A337F5617A7BF59070DF05CC433B6463384E8687AF3EDC197E447609A0D86FE25BA3EE2717FD470F2620A8FC3A2998A7C3B3A40530D0BAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................:W....@.........................`...........d....P..p............R..X....`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107553328820263
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrN:KooCEYhgYEL0In
MD5:	66113683EEFF6CB4718858007ACE3FFE
SHA1:	FFF151D41EAAB51C611A973E97DE8A14E31C7F93
SHA-256:	9BCF307E4CE299241696775FCA227E18710CDA5205291C280BDE480648684A0F
SHA-512:	33BE3766E445493EBFC7A0D61D814C4ECE228CA94787BC2311CDFEECD520E88CB6E6BD145E704998B17ECFCFAF0C35265015ED65CD3576B9FC1CF0F077C7317E
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0f367cbd, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42208467235953084
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:3azag03A2UrzJDO
MD5:	0F8BEAE5FBCA6E40A9752E7C19D0E47B
SHA1:	A9AFDF7F68742911555ECB539036D18C26B42431
SHA-256:	0219956EA22EC10641AB2E62B8990FA13DFBA366689EF54DCC6433C822BE2292
SHA-512:	92FB929C772C43C38E867E94DBE97372485BBA18B603CEDACE0B0A9FB2137183804F5AF905D5777B90155A6D73B2F66ABB43816006A43FF0EF87A9DCEA9E2B71
Malicious:	false
Preview:	.6\|.... .......Y.......X\...;...{......................n.%.....:....\|..,:...\|..h.#.....:....\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................]R:....\|..................^.c.:....\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07528424600951039
Encrypted:	false
SSDEEP:	3:em/setYe+9pKfWWl//LlteV1uiuulwwl//ollOE/tlnl+/rTc:emdzmpOhl/DlwraulHl/ApMP
MD5:	346B800EEA2A37052A2395672EE6847A
SHA1:	819EC7BAE5A4465FAD64CC97B8ED80F1C7E8E309
SHA-256:	DB472621873ACA08969BE9A08B54353A68209E081B51C67E0841D7FAB4301E5C
SHA-512:	79082A4417C8E5A6FE0BF2ABC37636AC91C0A094D60232B60855CB7DF81A08FFB44DEC5D15D4C45F3B748FC568E53A01995856FE7B50B9D6E1DFF151BEC72A40
Malicious:	false
Preview:	.........................................;...{..,:...\|..:....\|..........:....\|..:....\|..%...:....\|..................^.c.:....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Remote Manipulator System\Logs\rms_log_2024-12.html

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	2993
Entropy (8bit):	5.463562083906246
Encrypted:	false
SSDEEP:	48:SpiroU8xNqcoYERDML6RLi7rNRLigbqNKKkdgIOs7Zto4j2K3is4NGF5FJ:lr0xccoJxML6RLidRLi1ongK1xiNm3
MD5:	E4E74FEFA00EE0A8B97872550E07DCCD
SHA1:	7BDB9273E6E525A921084E41DD065C2DDEB8F7C0
SHA-256:	A0688FCB1FF15B0258090AB9BACCB64BBA92AF3DD85D571B9733E808390F6748
SHA-512:	DF4D921F346A484ECB59B1A25F4560200E3573954D9BEF31A6CB140856A55C61DE0C597FE507364A23472205577EF4D72D796F354D1F56DFB4FE628C68565A68
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>RMS – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = parent_node.chil

C:\ProgramData\Remote Manipulator System\install.log

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.039741216269087
Encrypted:	false
SSDEEP:	6:oBIkLmKRL/9BIkLdd/ao9BIkLhHujHO7eVVBIkLwmnXjKV9BIkLOLGeXkRLNWy:oBIkfjBIkDSo9BIk9Be/BIkRTiBIk6r+
MD5:	DB6B1F26FA6B988AEFFDFC190750DFE4
SHA1:	4E028B28E7B99A315848770C3889A28F22921B04
SHA-256:	2B82D82363C9976EBB006B2A5B280EC6A25BC98EE1BFA5A9A1DD6FA3CB98C043
SHA-512:	E0A960C51E95F714A327AE61C116F97FC8509D89A8DB2B4093547EA12F93BC97FB7D67AB3C07F61839E26D25B16DB8D3212F028F18FDE590E1600C9004CD7153
Malicious:	false
Preview:	03-12-2024_02:58:57#T:SilentInstall: installation 70270..03-12-2024_02:58:57#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..03-12-2024_02:58:57#T:SilentInstall: OpenService: service not found_1. OK..03-12-2024_02:58:57#T:SilentInstall: CreateService. OK..03-12-2024_02:58:57#T:SilentInstall: finished (installation) 70270..

C:\ProgramData\Remote Manipulator System\msi\70270_{77817ADF-D5EC-49C6-B987-6169BBD5345B}\Word.msi

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4540798801421673
Encrypted:	false
SSDEEP:	6:kKTYy89k8JFN+SkQlPlEGYRMY9z+s3Ql2DUevat:7P0ckPlE99SCQl2DUevat
MD5:	DD060B1BC768CB1214B4EB5BD36828E1
SHA1:	5507366C32F8AFB7436F6FBF90B512F8A6F01B33
SHA-256:	2560E4F6FE0C88122F9D3B53F9DC8AF4DDBF58FABA1E4B7CC56D2BB43E926DCE
SHA-512:	5F75436D01D722119447EB6E46DC2376F2B3E1F752139CACFDBDB917F97F21667DA2C264B4BB3029A2C9520AB79E6A8BC8F41D6302391117E23F4F0B90207F98
Malicious:	false
Preview:	p...... .........../YE..(...................................................@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.839874938955281
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxJJxl9Il8ucp6PxAWPrQSSpHNU5Q/PBd1rc:vp9YWp6PxZQ5gQXi
MD5:	A83840BD759694F8E52D50E6EDC40017
SHA1:	AA05CC2C7A41309134204B3BDEAB0C29A5F50020
SHA-256:	2D718B5C18B485FE7306B935A941F3409674C82A75FE46EEA635DA687E9DA675
SHA-512:	0A8D08F9C16A616C1FE60072AFC8CA852304CCB9EF7C8CBB6167C86D9A66BC014422D16319670880ABCE93F5D47B7EA93D7149D51153ADC9A57D805076F6A1D4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.e.L.j.2.F.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.4.Z.c.h.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8995882772562536
Encrypted:	false
SSDEEP:	48:uiTrlKxJxVxl9Il8uctwD/PUd8mj3g58mVsVk8Bfo4Jm6lNd/vc:wYWtwD0j3MeVycm66
MD5:	7EFA634935D3C1B8DCBF88E869B88C99
SHA1:	03697C16B864A024518BDF0179B1DBCD09CD2C95
SHA-256:	8EFF2344166FBDD434417AED291C7AE9697763A80B1411785C1B333698ECC824
SHA-512:	78F81B833E253DA48A338CE63E6924EB48AAD82701EE981FF9B6E19DDCA01808D13BEA3A72DEE2732CBBE493EC5A94F28727F3EC94C7285810E2D4B2622DD0AB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.T.I.c.p.y.p.k.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.4.Z.c.h.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9976547747737956
Encrypted:	false
SSDEEP:	96:MYWY09l0RlgWNbdJybyS4+5QCUdPYlbWJHQI50HVTSzU:Mh9WuEGyS4aUelbWK11T4U
MD5:	CCCCBAFE0C324577AC7C794044282A5A
SHA1:	C87A795A1C735CFCB15D96D10D5AE5EA725C0076
SHA-256:	7BB7C6110FF445BC0DC1D89287C0CBECBB85907D824B03F4D8C260488D48DE18
SHA-512:	8DC4E904F3942927EA1EF3BDCA808F4C959099C21F7D8CD5E4DA8D52B3B34C663DD80F15B2D15EE95407732C7404232C751D054998B7BD8640C6AA180062D3B9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.I.m.N.d.V.l.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.4.Z.c.h.H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C7FF197E.jpeg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1428x2020, components 3
Category:	dropped
Size (bytes):	217242
Entropy (8bit):	7.641248072397463
Encrypted:	false
SSDEEP:	3072:0yKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGq:0yKKhEKBSf/vv8vyNjz9oltkyY2
MD5:	6CFFBB054A1BD06B3B1018684467A551
SHA1:	347CECCBDFCE4CB2AA96F90735C2F5975E9ABC3F
SHA-256:	E0967AD8F4F2DF25AD1343AABF1C144E48D83BC3E61E2122F5BBF9A83EA63709
SHA-512:	24726671FEFA5228737C2E3E2CC159ECA90CD770022051A07C4C059B5378DA251E70568C956CB00631E12424FF5218E7A9A9BE30B0F4D47C277FC470218F88F0
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:(......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C1FE6FE1-F602-4A1D-8977-57FEA5BED477}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.09783851312991518
Encrypted:	false
SSDEEP:	3:llmn/lLfn:YZn
MD5:	881EE5BD27A267B0F01FD15E90AC4309
SHA1:	39D217D0F4BDE69A9A163E9F6C5728FDE81907F7
SHA-256:	90305EA213DDD5187AC57A744160391E8F9CD88FE8C355170291294739AAE912
SHA-512:	870D03A7DE2D66778F5199708387802196419BCA134EF50F6279715EC0EEFCB01AAE209ABCB790397A855301409EC6403A3B002214CB5B07153AD4CBD7B556B7
Malicious:	false
Preview:	../.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733212722165103500_A6C4B39A-2BE5-4057-A53B-D4796EF97CD8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.015323242247846756
Encrypted:	false
SSDEEP:	1536:ywTuT3WODAm3SjVg9k9XYNURZNzsCE+ocK9BE:hK
MD5:	35CC78D8D787E1EF547E341C5117FB2F
SHA1:	EF5DDE67CD62796C18CED4858BBF2AF2DD08A1D8
SHA-256:	0D21C80B9BA5520F8D562BDD116188F383A0D4D2E4B59CCDF7E02771C05C7C00
SHA-512:	E08B614FF0BD2A7B5A26FE1E23263970F7860143A4ACB16BA226CA46107FC93A7250C36BD7108CD85209317026DDD7518FF8AAD9FBF98E57EB093A2B362C2147
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/03/2024 07:58:42.463.WINWORD (0xD08).0x1998.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-12-03T07:58:42.463Z","Contract":"Office.System.Activity","Activity.CV":"mrPEpuUrV0ClO9R5bvl82A.7.1","Activity.Duration":291,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...12/03/2024 07:58:42.478.WINWORD (0xD08).0x1998.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-12-03T07:58:42.478Z","Contract":"Office.System.Activity","Activity.CV":"mrPEpuUrV0ClO9R5bvl82A.7","Activity.Duration":4611,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDia

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733212722166669200_A6C4B39A-2BE5-4057-A53B-D4796EF97CD8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCD116B.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD116B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD1229.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD1229.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD143.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD143.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD173C.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD173C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD17EA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD17EA.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCD18.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD18.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD1D1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD1D1.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD1D2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD1D2.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD1D3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD1D3.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD1F4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD1F4.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD22C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD22C.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD22D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD22D.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD23E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD23E.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD240.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD240.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD252.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD252.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD263.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD263.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD264.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD264.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD28F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD28F.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD2A0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD2A0.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD2B1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD2B1.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD2D3.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD2D3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD2E3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD2E3.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD2E4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD2E4.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD305.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD305.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD315.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD315.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD326.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD326.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD337.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD337.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD347.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD347.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD387.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD387.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD397.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD397.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD3E6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD3E6.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD3E7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD3E7.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD3E9.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD3E9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD3EB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD3EB.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD41D.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD41D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD42F.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD42F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD430.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD430.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD452.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD452.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD463.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD463.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD473.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD473.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD48.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD48.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD494.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD494.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD4F3.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD4F3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5A1.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD5A1.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5F2.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD5F2.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD603.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD603.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD73E.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD73E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7DC.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD7DC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD81C.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD81C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD9E3.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD9E3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC76.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC76.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDD24.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDD24.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cab10ED.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab11BA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab1595.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab174C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cab19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab1E4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab205.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab206.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab207.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab208.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab209.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab20A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab21B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab21C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab23F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab241.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab275.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab276.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab277.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab278.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab279.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab27A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab27B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab27C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab27D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab27E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab27F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab2C1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab2C2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab3E8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab3EA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab3EC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab40D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab41E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab431.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab432.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab4D3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab571.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab5A2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab5A3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab6DF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab7AC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab7EC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab9A4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabB5B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabCD4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabFF74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabFFC3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabFFC4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabFFC5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabFFC6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabFFD7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:NVrt:
MD5:	0F17C3DC027FDD98756BA46ED2ECFFA9
SHA1:	4272400848F7DBE251D045480C1B646D800C2B0E
SHA-256:	B84F176E34205C685DC12BF069084D343C83896E961AD7BB9659A0A70B2A73F3
SHA-512:	B834B9FC6D2CBECDE8A28C2C1E98C55F4DF7B207FF3C592345FBFF4E3D9AE828E6821F06EFDCFE14895D7FF23D7DE2548FB0A9A792B0D693069FFD71E84BD80B
Malicious:	false
Preview:	....z.........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Doc.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Dec 3 06:58:38 2024, mtime=Tue Dec 3 06:58:43 2024, atime=Mon Dec 2 20:13:15 2024, length=230038, window=hide
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.547429898539797
Encrypted:	false
SSDEEP:	6:4xtQl3UiuJUatl0kl//QMLysvq/Rsxt+IcccljAlxx23LXlIRo3wGim6qnavGmZ7:8NiuJZl0sXQKIgucUjAULXlrF6qnBmV
MD5:	2A9AD72442594D5D691F0A10A8C2F9B3
SHA1:	4129DE74709ED49447F632CD6FF5314D5AE7EDCA
SHA-256:	8B34D6183F52346942C6B63290371EB979391EC2AD2F4D686257B5AEC05AC647
SHA-512:	76BE77B7FE4F6CF546DE2015B8A7615A512AC47B495BC189AF260A3823BA8315FCE8CBD0F055E930ADE179524A4EDB09C3A38EE890F5A7F699A76804EEDDEDCF
Malicious:	false
Preview:	L..................F.... ......)YE....,YE......D...............................P.O. .:i.....+00.../C:\...................P.1......YT?..intel.<......YT?.YT?..........................N1..i.n.t.e.l.....Z.2......Y.. .DOC~1.DOC.B......YT?.YT?..........................,dE.D.o.c...d.o.c.x.......@...............-.......?............F.......C:\intel\Doc.docx..#.....\.....\.....\.....\.....\.....\.....\.i.n.t.e.l.\.D.o.c...d.o.c.x.`.......X.......494126...........hT..CrF.f4... .b.T..b...,.......hT..CrF.f4... .b.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.247557492317427
Encrypted:	false
SSDEEP:	3:HqdLBCm4UcBCv:HA9hGs
MD5:	CE7BCCD008058E0D96C85995FABBDC9F
SHA1:	939A8927196DC4C5E90B32234C1484B72052F5A1
SHA-256:	2AD83E8B46EF787ABC53DC07C6D648975AF14441067BCC46017DA2B1A3DEE6CC
SHA-512:	6D2B32C16C0B0E330EDC39C20F0666CC128F5A16D82E34837D7951FE71E02B8A5BA20CD3F0ECAA58D570B110FFCCA113FC87D4CA5C4ACBE3B557B21F20CAB872
Malicious:	false
Preview:	[misc]..Doc.LNK=0..[folders]..Doc.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ABG42LV2B96XQKVW5DP.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HNWZICF5PY72W3FNQRC8.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF2d622.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\Installer\3c2b90.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\3c2b93.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI3053.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI31DA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1447471
Entropy (8bit):	4.9359290577138335
Encrypted:	false
SSDEEP:	24576:2MMMMMMSLLLLLLLFMMMMMMSLLLLLLLsMMMMMMSLLLLLLLi:2MMMMMMSLLLLLLLFMMMMMMSLLLLLLLsb
MD5:	A3DE4E425C8D91DBC0DF62FDAF41DE92
SHA1:	8B5D09E89D06AAEECEDF1AB71D1958F9C7822E4F
SHA-256:	EC2CF0D66E92D5DB546A56016FA36A031CBB3FCE7E411590A81D0FF934F8AE10
SHA-512:	D280C8F41D86CF8782B47EAE23D7E7097F4926B8C017619267E3C891FF1827EC98672F980FFC78E0184DF2378602C285AD4D0A3775F9B266660A9B6911613410
Malicious:	false
Preview:	...@IXOS.@.....@U..Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.]....@.......@........ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2....@.....@.....@.]....&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}8.C:\Program Files (x86)\Remote Manipulator System - Host\.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}...@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}D.C:\Program Files (x86)\Remote Manip

C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.161373901427909
Encrypted:	false
SSDEEP:	12:JSbX72FjUlAGiLIlHVRpzh/7777777777777777777777777vDHF5t07x6uPp01z:JwQI53vt016uy8F
MD5:	D57527B0B0A77CC4C61D5BD585C4F90E
SHA1:	99D603BD2C66F5C347161CA52EDEE3F24E98D242
SHA-256:	8C155F1B59CE92F5CF2113B4E8A8877E512051DD0FD0997A28193E3E1CBA96D6
SHA-512:	F72801C06D6896FE710EE9978E498354BC724A68F5F2C80F2C78179EC4D1E4BFA36A72C54A5FD9388D32CE37458FD29B26F9641C573A63ACEA34223418186E42
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.923650457531865
Encrypted:	false
SSDEEP:	48:Dr8PhhuRc06WXOcFT5vUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:+hh1aFTZUUGkOzs9t4pqvGkOzs9Hf
MD5:	B787570A79D27186482D199BD3A2601C
SHA1:	CD45074BD7EC1C282999A842AD56D20238C349E1
SHA-256:	E3D71261F200C0B83E74BA58360731866FD88D0847C421D3706427A8E76C2799
SHA-512:	831061CFA3661F9F5B4C248E49E3F93DCD545E7FEF2395EB03F042BFE7333FDBF59EB264D43EFE75295493D09FC6EC27199F0A97BCC8EA38F1ABB35E477F27D0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79000
Entropy (8bit):	5.817675016279098
Encrypted:	false
SSDEEP:	768:/MAyYdTmPJbgqcnDckJ42T1IPAMxkEo2T1OtoAMxkEbK:/1U81ckJ52xVPxnK
MD5:	E8CBBBE641AA6205C0E028CE7DC72CFE
SHA1:	E845FB6044E5F611F4F990B76AA4762FAB6E96C9
SHA-256:	61481606FE3FF53C9483586B4A95181D96F5679667ACCD582166069B10233D77
SHA-512:	D12E6BBA83F1B41BB2B937B315C5CDD3ADFA60C318AD1E958D99251822810739D2C6EC75B664BBC3116B0CDBBBFA4BEBA234B8C604F303391E21CDA0C24767E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(.......t0...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	5.60723121147002
Encrypted:	false
SSDEEP:	768:RdMAyYdTmPJbgqcnDc/soJP2T1qAMxkEvQ2T1h8uAMxkE4:/1U81cLJOGxF/hxM
MD5:	F0F36966AD2B91DBE0C8B9D4E0A1AB0E
SHA1:	B7787445DDD42A3B4753AFC0B02B270DDC1693FC
SHA-256:	BE3C9594F315F2CE2698DFF54F7B41F012B25BF208DD88CEA7AC92936EC84AE9
SHA-512:	B178A35B3F0A3CA67D632901C1F0AF309F51267DFA827AE029475C63BCF2BA51694C717C94989D7E457E915DAE74B43C3C6B405113249A7B1FF0E9BAE67E0949
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.........................................................................4T..(.......\................d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.6899574334599645
Encrypted:	false
SSDEEP:	1536:c1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL+:UjcT6uuuutMMMMMMSLLLLLLLeYTZg
MD5:	6A9AA00C428A946F9A5C5546A458ECA0
SHA1:	06A70B197DEE2FC106576C6719CFF046D2747396
SHA-256:	16601981E37F2FE16B8E0EA4626ABF57013458B63D1A71C8FA3B5080F3C191F5
SHA-512:	EADDEE089D18ED744BB1DCAAA98A8F6E201022432C55D037D2A7EF994532197EF595E44DEEF9DB0CFAE8ACA50F4AB90CEEDB49F8E920E6B4FAF6C60B6EFEDD51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................v.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690218208041496
Encrypted:	false
SSDEEP:	1536:R1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLe:DjcT6uuuutMMMMMMSLLLLLLLeYuGVk
MD5:	AB85C5EEAD096C4E5D0A2914C24F59B2
SHA1:	E189F9BA583B0A4EEE1C817C9DA8A5D72A038A83
SHA-256:	F4F656CC3CD99ABC4CFC1A70BD77C52E36D59852987BE530E131CEF8238F4BA7
SHA-512:	E70ACF9FCA9F0378FAC97421550984FF166D8D1D83F423400B108E804CA876EA6D7517398637D64C34CC0E46C14048BB9F50C8268D993FA983DB6B0E44A9C352
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................>.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690232052098797
Encrypted:	false
SSDEEP:	1536:o1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLU:IjcT6uuuutMMMMMMSLLLLLLLeYFuv
MD5:	03A18CE97AA1C45D834524B8A408BC17
SHA1:	72ABD8B4AC974928684B6D089F8573C70D431808
SHA-256:	0ACFCA29B6128E0161B4E6D93FFF7686A96128016846625763DAB7F9CE059DEF
SHA-512:	2A2DC903E4179EC83BB4FA557FFCCE8BA3D8FC175E9C817D34BA186704ECF06A281D96D35B12B8D54FE35683030942FDC9A3A1FDFDBEAA755A60436F3C7B3483
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@........................................................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375175310962875
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauQ:zTtbmkExhMJCIpEr5
MD5:	CF5F9348B6C0C4325B69325EEBBDB972
SHA1:	290F98E0F235EBE44D1400136845D3436864F2FB
SHA-256:	E0DCF2801CBB00232B1862D9AF7389C3CD3CE6253CB419B280D71147C24FCAD9
SHA-512:	1C318FC10BF41073A02A2BED6FD5CB820E2B8A442DFF82C620EC1296E6DA641276B886FA7933BC31E5F5CD36130D6C7D7F0318F62BFC62FD773FAFB580A2A8C4
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.600066630143131
Encrypted:	false
SSDEEP:	24:Vk1IBjhQbwTcjgArtuFPSGBAS7jF78oekZdCrphruWeI8h6FfymkBZGfKkamo3zK:3QbwDj9BdCusxIsfLamo3T6
MD5:	8FB130F5B59F5762C3725C5EDA4FEF8C
SHA1:	71335C56C7427E97B42F31AD741EA3D0DF29FC5B
SHA-256:	5548A1E83E868D3D6F20C135864757DD962C2BE4B4697C3DD273BFE90E318071
SHA-512:	3BDD74D0C6097BE27C3807E914AF80B07747F1A73C8553AAFC2409ADD4EBB32B48774002597E7F0F1CD693E24859DA35F68DE5800554D08A4018CE74EC41563D
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........j......t........20241203060259Z0s0q0I0...+..............B..M.%..Dg..5 .....F...x9...C.VP..;..w.......T..r...G....20241203060259Z....20241207060258Z0....H.............+.,T....5...0."(....&.+v..^x~C.j.x..en..;..G.....F.gl.^(...j"T......~.XXz...!~.fch8..L.0.......p..[...w.i..m...@....._.g......h...UU.p\o..o.P.Vb.hx....9.u...k.\|:.]...CF.....?.<"...iC.<K)P.IC..E.^...p$2>`....}....{....f$T.5.. ...o...?].t...I....0...0...0............\|.w.7@$.L.!...0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...240717031756Z..250215000000Z0g1.0...U....BE1.0...U....GlobalSign nv-sa1=0;..U...4GlobalSign Code Signing Root R45 - OCSP 1.2 202411070.."0...*.H.............0............U...;..pc+..o.K..0...6.'...F.C..}.....%E..F.q.-\.u{..$.....#8.,{...^OEQ..P..~ZU..f.0........Ky+..(..q.............sy...e.0...Z.]X1.A....z.....g.p.{.~,u.0R..f.SOx".Q_.{......`T.&[&2..P\|.......h.Z(A;.3.]$...k`.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.609103808405835
Encrypted:	false
SSDEEP:	48:+sR2QSKyg2G237nIxCw5DgSUnpU446J8WpNTE:F9Z2N37n4Cw5MSiw6mOTE
MD5:	9B7CEE7FC2507E7B498924A5DD1F64B7
SHA1:	703360D20DC050704F9E518722F1EB59E07D237F
SHA-256:	406E6229A2C02CEA8A1314AB7D8437BBFA0341CE545E196B28F9A2990252ABBD
SHA-512:	9C20F9FFE6EF56534678A3FB7CC3882602FF772BA893279437D32026AAACC83F8F7EA442C9D438593DA21AFAFF640903ECA604BEE302C5CB2A7ED7841D504CB0
Malicious:	false
Preview:	0..........0.....+.....0.....r0..n0............`...H,.&...=...20241203052001Z0o0m0E0...+...........r...nK..._..[.Q.....$..kw...Y.!gdv.x..vF...M...k3....20241203052001Z....20241207052000Z0....H................ih..]."...h.vc..]f.......M=\|..Z./.......`.....I...:.AP&.%.rn..6"..Z...7UD,...D.N.W.!..K..B.B;.!.....j...Z....\......C.L>..N...-.y.xM....%...)...p...?o.,.....@U..Q...G......... ...u.pQZ...y<$Q..9....-.y.Rr.%....V..}...!N.?..s.z.X..>D/...F...l....0...0...0..........f3...z.....0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 20200...240920234113Z..241221234112Z0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'gsgccr45codesignca2020CA OCSP Responder0.."0....H.............0.........+..6b.I...$...f.C.K?}.s...r;.y.m,]q.....@.N.2..x.F5Y........%.).....>.yH.....*.\.9.<..ns..,..jQ.....~..V.N..Y.........8.a..Rg..A3....[.p<......by..Y.y...9....7%.%.i$..I..T~........2i....R..rW..~.!..e...;....\.9;<L.._..I.Fe.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.512146146896367
Encrypted:	false
SSDEEP:	24:qnjIZwv6A6lPxYYsLLeggpNORwfF7YpQfvmE1yPq8hruWa2tHP+HLuuDXXWLaH:Nuv6rpeY2epORK9q3nPq4uRY4LuubXv
MD5:	202BEE7796FAD3E0BD2EAC1EC2626DE8
SHA1:	016F6CBA78AE2767B0BAA65122ED510EA8BAB907
SHA-256:	04AA0DD38E6549F10CA7D666BF0E52B077DA3DB81BFE4379582A586998263F75
SHA-512:	CDC1B23ABD9A4525AEFE4C5EF48173626493B5F8B978523809E6A35C1B47E1F69DDA829BC1EC4D55CA17F6DDE5BD47B4CBDC77575844C219EF1B54C94FF82188
Malicious:	false
Preview:	0..........0.....+.....0.....}0..y0......$L..\|6..h(4.]........20241203065702Z0s0q0I0...+..........h.$..y.u.3.V..G.....K...E$.MP.c.........x..BEp.A.o...T....20241203065702Z....20241207065701Z0....H.............i...g.^'y.....p.....\."z)<....K5.K.lA..SP(0B?...R.%.\....@.3IrE.._+.....4.u_...}..... ....C8...G@-.....h.Z....LM.p.f...y7.gh{.....R]`....6.>.t...x...8.tu].A........P...&F..W;.d.`.w......R@.5.I[.L..'x.`...=A.....P(y..T.j..)K^..,kP[eI...^.'.6.{....0...0...0............\|.X........-..0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...240717031720Z..250215000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign Root R3 - OCSP 1.2 202411070.."0....H.............0..........U\m..$.o@E.<.c..).S..L...HN.<W\|.F .........h...zo..vk..%M.".j.P..U!/..v.Th.R..(.i..$P....^l..@qe....q.l..6....cB.:.;.KU......J..>.....$..(.h J.6;.....N..(r).i....o.<-..c..2.]<.7r.../.Ni..}q...8B.LT./'...=b.>....C........"..

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	532
Entropy (8bit):	4.029475297264721
Encrypted:	false
SSDEEP:	12:znz1fDWzJqe3KQj22iv8sFF1gUeMalCrlQNlVgfMGSzlK1uP:Tz1fDgJRjYvP+U7uCKlCMtJI2
MD5:	113E088DB8288D981EF6D6F8315E19C1
SHA1:	442E00B72AF7B400C5049DE4E32D3F462C91B434
SHA-256:	E3E886384490B676A8CA4B81732DBEF6F76F25BFCD21CE62F8A334D1527A24D1
SHA-512:	63E4E8F75B5D4EE8DC3E2B1B88E2F17F721689F1B74989996701D30D81F60BF2DBFAEEF1A1539E89C28341D425954FDFC6C431E8D9641A95A4917F5526B6B370
Malicious:	false
Preview:	p...... ....J....:T:YE..(................+..IE......mH......................mH.. ........+..IE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.Q.V.F.Z.P.5.v.q.h.C.r.t.R.N.5.S.W.f.4.0.R.n.6.N.M.1.I.A.Q.U.H.w.C.%.2.F.R.o.A.K.%.2.F.H.g.5.t.6.W.0.Q.9.l.W.U.L.v.O.l.j.s.C.E.H.e.9.D.g.O.h.t.w.j.4.V.K.s.G.c.h.D.Z.B.E.c.%.3.D...".7.1.3.3.5.c.5.6.c.7.4.2.7.e.9.7.b.4.2.f.3.1.a.d.7.4.1.e.a.3.d.0.d.f.2.9.f.c.5.b."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	3.879515564289567
Encrypted:	false
SSDEEP:	12:alOtpCW8gzpDWzf79bLgLzK8sFAY6ealztksMGH4Z+h:7p3zpDgz9YLmvqY6mIh
MD5:	EEE67ECF8B5EDF29DC840A0CA1687F51
SHA1:	744FCD3BC5277C4BBE4B2C1EA28A41C1EDA0B681
SHA-256:	5F44F6ACCC60AE8713A577491E7648696E3D5984C7EFD2967C35B0F9C6B52D4A
SHA-512:	8633045AB76131E58B8E0E9866A2511BA1924B02AF8867246DFC190EB7EFD228FDBCD7F6BD470DA7BA681B6FD2FCF8480BA5C1E6FE55D1BEB5BE2319E135CBC5
Malicious:	false
Preview:	p...... ....V......:YE..(.................o.CE....~.gH....................~.gH.. .........o.CE......V....:..........h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0./.M.E.0.w.S.z.B.J.M.E.c.w.R.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.L.u.A.3.y.g.n.K.W.%.2.F.7.x.u.S.x.%.2.F.0.9.F.%.2.B.h.H.V.u.E.U.Q.Q.U.2.r.O.N.w.C.S.Q.o.2.t.3.0.w.y.g.W.d.0.h.Z.2.R.2.C.3.g.C.D.H.Z.G.D.p.D.i.h.E.2.3.%.2.B.Y.N.r.M.w.%.3.D.%.3.D...".7.0.3.3.6.0.d.2.0.d.c.0.5.0.7.0.4.f.9.e.5.1.8.7.2.2.f.1.e.b.5.9.e.0.7.d.2.3.7.f."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	4.019471982195225
Encrypted:	false
SSDEEP:	12:Nbt5G+zbgDWzFU8iv8sFt4QAfROA/pUL3oT4SHEm:Fr3zcDgFUhv/ofROS6L8Em
MD5:	E7FB970B19E532E1864A1ECBA5E261C6
SHA1:	ABAB77A006227447773C96B7EE8A32B9D01207DA
SHA-256:	DCE4217481531FEC059F2100CA404F4AD0BA75EA02F3AF3D032688824633D6FC
SHA-512:	DCA8B39EC584D227BC31D1CEABB2394DE97E7A8D293A9A40F7AD5464CDDDAC4FE0FF15B3DF4E99D19CB1B2D2047AB71E7BB3A8FCF198BF57E1A90F73E40FEF83
Malicious:	false
Preview:	p...... ....2....d.:YE..(...................PE.....7uH.....................7uH.. ...........PE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.r.o.o.t.r.3./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.1.n.G.h.%.2.F.J.B.j.W.K.n.k.P.d.Z.I.z.B.1.b.q.h.e.l.H.B.w.Q.U.j.%.2.F.B.L.f.6.g.u.R.S.S.u.T.V.D.6.Y.5.q.L.3.u.L.d.G.7.w.C.E.H.g.D.G.E.J.F.c.I.p.B.z.2.8.B.u.O.6.0.q.V.Q.%.3.D...".0.1.6.f.6.c.b.a.7.8.a.e.2.7.6.7.b.0.b.a.a.6.5.1.2.2.e.d.5.1.0.e.a.8.b.a.b.9.0.7."...

C:\Windows\Temp\~DF157EA61B159E2FA0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.923650457531865
Encrypted:	false
SSDEEP:	48:Dr8PhhuRc06WXOcFT5vUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:+hh1aFTZUUGkOzs9t4pqvGkOzs9Hf
MD5:	B787570A79D27186482D199BD3A2601C
SHA1:	CD45074BD7EC1C282999A842AD56D20238C349E1
SHA-256:	E3D71261F200C0B83E74BA58360731866FD88D0847C421D3706427A8E76C2799
SHA-512:	831061CFA3661F9F5B4C248E49E3F93DCD545E7FEF2395EB03F042BFE7333FDBF59EB264D43EFE75295493D09FC6EC27199F0A97BCC8EA38F1ABB35E477F27D0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF20D9006ED9A458F1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF28688BB4841DED0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5174651351014843
Encrypted:	false
SSDEEP:	48:IwZuUPvcFXORT5XUkyeUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:hZ+MTZt1UUGkOzs9t4pqvGkOzs9Hf
MD5:	17684F13E337752476A76E308BD51AB4
SHA1:	CCC97C7FEB02A4739EB3C19F56F97BB1627EE9EF
SHA-256:	BD1FC8D386C72E1D0B1532F2B9F12D04585AE4693FFDED35411DDA8CDF471A79
SHA-512:	A0B25581D81358E1EE07BB8DCEB744313ECA49CA81D8157C7DECD3D764E0E044B51D032CF46843848D278CEFA5A3BB298A062FB57E4EC74FF4013CADDB6E3708
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3599498361F0171D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5B12386950A89C61.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF64FBDC7A7C0C60AC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06843743119485104
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOZft07x6qkWrkoVky6l0t/:2F0i8n0itFzDHF5t07x6uC01
MD5:	B23A8F32998499DA774A3479193D91FB
SHA1:	0FE95AAD29FA238A9488C7C9BF7E1E265A18497B
SHA-256:	3272D0750CE59B4FF12F23F507659A50D8EC4C4562130BD41A529780E660C33D
SHA-512:	DBF24A27950DB9528F76E5FCD10F74518083DBBEBB583EA4CDD4295B3122B16640F7AA9C5E3D27DF38E2B0B40E89FF575FA3BBAF249FC0DBB25A4CAA9F7FB30E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6E713CEAD42946AC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.923650457531865
Encrypted:	false
SSDEEP:	48:Dr8PhhuRc06WXOcFT5vUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:+hh1aFTZUUGkOzs9t4pqvGkOzs9Hf
MD5:	B787570A79D27186482D199BD3A2601C
SHA1:	CD45074BD7EC1C282999A842AD56D20238C349E1
SHA-256:	E3D71261F200C0B83E74BA58360731866FD88D0847C421D3706427A8E76C2799
SHA-512:	831061CFA3661F9F5B4C248E49E3F93DCD545E7FEF2395EB03F042BFE7333FDBF59EB264D43EFE75295493D09FC6EC27199F0A97BCC8EA38F1ABB35E477F27D0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7614BE98FC077CCE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5174651351014843
Encrypted:	false
SSDEEP:	48:IwZuUPvcFXORT5XUkyeUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:hZ+MTZt1UUGkOzs9t4pqvGkOzs9Hf
MD5:	17684F13E337752476A76E308BD51AB4
SHA1:	CCC97C7FEB02A4739EB3C19F56F97BB1627EE9EF
SHA-256:	BD1FC8D386C72E1D0B1532F2B9F12D04585AE4693FFDED35411DDA8CDF471A79
SHA-512:	A0B25581D81358E1EE07BB8DCEB744313ECA49CA81D8157C7DECD3D764E0E044B51D032CF46843848D278CEFA5A3BB298A062FB57E4EC74FF4013CADDB6E3708
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF829F07718188B98A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5174651351014843
Encrypted:	false
SSDEEP:	48:IwZuUPvcFXORT5XUkyeUSKdgfdguOdghRXdgkdgpdgKdgt6AdgNi2SBwdgfdguOo:hZ+MTZt1UUGkOzs9t4pqvGkOzs9Hf
MD5:	17684F13E337752476A76E308BD51AB4
SHA1:	CCC97C7FEB02A4739EB3C19F56F97BB1627EE9EF
SHA-256:	BD1FC8D386C72E1D0B1532F2B9F12D04585AE4693FFDED35411DDA8CDF471A79
SHA-512:	A0B25581D81358E1EE07BB8DCEB744313ECA49CA81D8157C7DECD3D764E0E044B51D032CF46843848D278CEFA5A3BB298A062FB57E4EC74FF4013CADDB6E3708
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF90FDFD90CAD75E01.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.27579776074621326
Encrypted:	false
SSDEEP:	48:2IOYXSBwdgfdguOdghRXdgkdgpdgKdg4SKdgfdguOdghRXdgkdgpdgKdgt6AdgNC:HOGqvGkOzs94UGkOzs9t4g
MD5:	FF63742A61206C5577607E5A95ED588F
SHA1:	FCC5CBE805D026EB89A9D1DE039411E39FE9EF9E
SHA-256:	B62F19CD0670FE051D8E2256FF47819D0631A8B1F4BA269FC441D4181C7B2AB9
SHA-512:	615F177DAB6BA848706EB1647494F01CEFF1FA4D68E779C31FB221FDCFC3F8A20294B631305E0F390BD7AB04BA8250A56B6B131902FF66E587BB25B187149760
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC4B1C00A439628CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDCA13FF7E1E05E37.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\intel\Doc.docx

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	230038
Entropy (8bit):	7.636957641054668
Encrypted:	false
SSDEEP:	3072:nzyKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGVVu:nzyKKhEKBSf/vv8vyNjz9oltkyYzcZ
MD5:	773D2787D661474A840B907C8A22D4E9
SHA1:	A6A0E3C4AB4063BC74C65D6EC0CB43B67F1D767F
SHA-256:	BA82FE356B21118D92B04A74EF8466A59F4802FD9B061F6E9A28E16CF7A5A8B3
SHA-512:	7EC868F9B7B47A757BBB5ABF5639F97C47D79AC55DD07954F3EEE93384B555F7C4C817B687C8C486DC97F4174A8CC04DEED342E8ADD6EA2EDB5EE381FC612BEA
Malicious:	false
Preview:	PK..........!..A..f...T.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E........tQUUH.},.HM?...../....;@..(..I6H0s.=.xF..V..\|...d..H..[!M....[.H....LY.9.B ....h.u..T...E......Y.....z."...:..X..~0x...&... ....l.b.......$.Mc....+..@.j<.p.a.).Y.:].q@..2T.=a!].........}...R@2e>.3.]tm....Fev....-...Wn.[.!.w.*k+.I.....q. \.....Qp...s/...W..c..R`...\....xj.....mNEb..[.p.....?..:...(O.um"Z.=.T.@.8.M.8........PK..........!.........N......._rels/.rels ...(...........................

C:\intel\Word.msi

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\intel\~$Doc.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.717661560909372
Encrypted:	false
SSDEEP:	3:t4qKF0n4ejBl4XRre0HmzFDkfUnYaL9q:JK+4ejBlYRreAm9kdaw
MD5:	6A3271C6232540F9D92EDA49EE371510
SHA1:	010073CEE7CBA8FDD39641A52719DB483B1328DB
SHA-256:	EBCF7A361BFFD5BEFFAFDCAF9E5B9C61016291B950602FF48AEBA4C1137825E6
SHA-512:	64A173BE765C9F04B26F5041D5DFDCED9ABD3B9150F4269ED18E4D4B1CED156E7E5D450E57147D8DAEA4864682A5836231DDE683DBF2F621D90E3FFDB57DA148
Malicious:	false
Preview:	..........................................................m......6..o......Y]lW..R.KIY..R.+k.m.Yv2.}...Ou{=.W.^m.7E}'...C..EYE......q..;\|...}.j.....Z...=fj

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998140922332344
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	442.docx.exe
File size:	25'141'051 bytes
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
SHA512:	fcaba4304f26eefa476202e17ca85c3f994d2086f78fa86f1d73f7d6c926825a4ac3b02ceae2d8cde3583f02fdbf87139741035368f6d4b77c4f8c790df330fd
SSDEEP:	393216:bnD8YsCFVxnq/mIhNAl2543UCCCQrTTNi5NRmclImNm/U29ieL:bgYlFV8/1AbOrXNihH29LL
TLSH:	14473325EE400AB1E2FAD47098159413D63C3C5DC228B2A722F997287FF7B755B67388
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0b03084c4e4e0383

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE9C0E53668h
dec eax
add esp, 28h
jmp 00007FE9C0E52FFFh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FE9C0E52483h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FE9C0E53193h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FE9C0E551A7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FE9C0E41A13h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FE9C0E54262h
int3
jmp 00007FE9C0E5A444h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1558c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1558c	0x15600	50f0a4d841d0856138dbb9d7187108bf	False	0.1905953033625731	data	5.443581422941128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x7109c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72648	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 15118 x 15118 px/m	0.06374955637051934
RT_DIALOG	0x82e70	0x2ba	data	0.5286532951289399
RT_DIALOG	0x8312c	0x13a	data	0.6560509554140127
RT_DIALOG	0x83268	0xf2	data	0.71900826446281
RT_DIALOG	0x8335c	0x14a	data	0.6
RT_DIALOG	0x834a8	0x314	data	0.47588832487309646
RT_DIALOG	0x837bc	0x24a	data	0.6279863481228669
RT_STRING	0x83a08	0x1fc	data	0.421259842519685
RT_STRING	0x83c04	0x246	data	0.41924398625429554
RT_STRING	0x83e4c	0x1a6	data	0.514218009478673
RT_STRING	0x83ff4	0xdc	data	0.65
RT_STRING	0x840d0	0x470	data	0.3873239436619718
RT_STRING	0x84540	0x164	data	0.5056179775280899
RT_STRING	0x846a4	0x110	data	0.5772058823529411
RT_STRING	0x847b4	0x158	data	0.4563953488372093
RT_STRING	0x8490c	0xe8	data	0.5948275862068966
RT_STRING	0x849f4	0x1c6	data	0.5242290748898678
RT_STRING	0x84bbc	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x84e24	0x14	data	1.15
RT_MANIFEST	0x84e38	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T09:00:05.231772+0100	2849354	ETPRO MALWARE Remote Admin Backdoor Related Activity	1	192.168.2.4	49874	111.90.147.125	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 08:59:10.301979065 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:10.422847033 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:10.422976971 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:10.437175035 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:10.437225103 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:10.557334900 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:10.557349920 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:10.557368994 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:13.445419073 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:13.499149084 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:13.629446983 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:13.749840975 CET	5655	49808	95.213.205.83	192.168.2.4
Dec 3, 2024 08:59:13.750015974 CET	49808	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 08:59:13.938900948 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 08:59:14.059129000 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 08:59:14.059214115 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 08:59:14.060105085 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 08:59:14.060133934 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 08:59:14.180190086 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 08:59:14.180206060 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 08:59:14.180226088 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 08:59:43.779681921 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 08:59:43.827410936 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 09:00:03.516463995 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.517344952 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.518137932 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.518829107 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.519726992 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.519759893 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.636400938 CET	55555	49869	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.637228012 CET	5651	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.637322903 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.637896061 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.637907982 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.637911081 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.637974024 CET	465	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.637989044 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.637989044 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.638024092 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.638391972 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.638422966 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.638766050 CET	8080	49872	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:03.638931990 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.639389992 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.639415979 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.639671087 CET	5651	49873	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:03.639712095 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.639790058 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.640391111 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.640391111 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.640410900 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:03.640439034 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.640464067 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:03.757843971 CET	55555	49869	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.757889986 CET	55555	49869	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.757900000 CET	5651	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.757909060 CET	5651	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.758297920 CET	465	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.758330107 CET	465	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.759361982 CET	8080	49872	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:03.759371996 CET	8080	49872	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:03.760343075 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.760360003 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:03.760368109 CET	5651	49873	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:03.760375977 CET	5651	49873	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:05.231409073 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:05.231710911 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:05.231734037 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:05.231740952 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:05.231762886 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:05.231771946 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:05.351727009 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:05.351736069 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:05.351744890 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:05.351787090 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:05.351797104 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:06.067918062 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:06.108716965 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:06.236949921 CET	5651	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:06.237055063 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:06.237087965 CET	55555	49869	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:06.237126112 CET	49870	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:06.237142086 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:06.237196922 CET	49869	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:06.357013941 CET	5651	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:06.357059956 CET	55555	49869	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:07.071435928 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:07.126240969 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:08.087800980 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:08.139894962 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:09.102555990 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:09.155535936 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:10.117701054 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:10.171145916 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:11.133913040 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:11.186770916 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:12.156270981 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:12.202411890 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:13.164763927 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:13.218055010 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:14.233542919 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:14.280570030 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:14.323785067 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 09:00:14.374346972 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 09:00:15.198080063 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:15.249314070 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:16.211422920 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:16.264920950 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:17.212007046 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:17.264955997 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:18.229716063 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:18.280556917 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:18.627902031 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:18.632432938 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:18.640340090 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:18.789397001 CET	8080	49872	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:18.793356895 CET	465	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:18.801419973 CET	5651	49873	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:19.242973089 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:19.296185017 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:20.243308067 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:20.296179056 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:21.258311987 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:21.311872005 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:22.273948908 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:22.327426910 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:23.274409056 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:23.327439070 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:24.289674997 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:24.343197107 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:25.290096045 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:25.343079090 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:25.550432920 CET	8080	49872	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:25.550626993 CET	49872	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:25.550715923 CET	5651	49873	78.138.9.142	192.168.2.4
Dec 3, 2024 09:00:25.550766945 CET	49873	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:00:25.567256927 CET	465	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:25.567337990 CET	49871	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:26.305634975 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:26.358758926 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:27.321026087 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:27.374365091 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:28.337670088 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:28.389961958 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:29.352334023 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:29.405589104 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:30.368542910 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:30.421210051 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:31.383896112 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:31.436830044 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:32.522397995 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:32.577459097 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:33.399602890 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:33.452613115 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:34.414923906 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:34.468091011 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:35.430478096 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:35.483854055 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:36.446176052 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:36.499452114 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:37.461719036 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:37.515063047 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:38.476980925 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:38.530586958 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:39.492949009 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:39.546329975 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:40.508446932 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:40.561856985 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:41.525248051 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:41.577487946 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:42.540806055 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:42.593198061 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:43.570858002 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:43.624422073 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:44.587079048 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:44.640026093 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:44.820097923 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 09:00:44.862093925 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 09:00:45.586707115 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:45.639996052 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:46.602340937 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:46.655643940 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:47.617897987 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:47.671226978 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:48.633831024 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:48.686878920 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:49.649194956 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:49.702573061 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:50.650155067 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:50.702507973 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:51.667279959 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:51.718167067 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:52.680609941 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:52.733746052 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:53.696150064 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:53.749389887 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:54.711993933 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:54.765062094 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:55.727521896 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:55.780620098 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:56.742933989 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:56.796390057 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:57.758866072 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:57.811888933 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:58.774281025 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:58.827511072 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:00:59.789686918 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:00:59.843251944 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:00.805775881 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:00.858762026 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:01.821095943 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:01.874423027 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:02.836867094 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:02.890022993 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.534677982 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.535819054 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.536712885 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.537008047 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.537245035 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.654623985 CET	8080	50003	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.654726982 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.655463934 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.655507088 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.655771017 CET	465	50005	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.655839920 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.656287909 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.656322002 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.656649113 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.656742096 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.656851053 CET	55555	50007	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.656909943 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.657089949 CET	5651	50004	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.657141924 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.657474995 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.657500982 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.657540083 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.657556057 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:03.657804012 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.657825947 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:03.776884079 CET	8080	50003	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.776896954 CET	8080	50003	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.777618885 CET	465	50005	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.777626991 CET	465	50005	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.778358936 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.778413057 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.778422117 CET	55555	50007	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.778434992 CET	55555	50007	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.778454065 CET	5651	50004	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.778461933 CET	5651	50004	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:03.852647066 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:03.905688047 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:04.867595911 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:04.921291113 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:05.883254051 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:05.936918974 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:06.290916920 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:06.291053057 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:06.291162968 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:06.322640896 CET	55555	50007	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:06.322731018 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:06.325416088 CET	50007	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:06.414319992 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:06.446605921 CET	55555	50007	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:06.899029016 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:06.952611923 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:07.916594028 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:07.968195915 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:08.931000948 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:08.983876944 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:09.946068048 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:09.999424934 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:10.946588993 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:10.999404907 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:11.962331057 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:12.015057087 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:12.977622032 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:13.030684948 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:13.992959023 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:14.046304941 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:14.165277958 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 09:01:14.213428020 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 09:01:15.009916067 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:15.061920881 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:16.023808956 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:16.077558994 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:17.048954964 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:17.093239069 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:18.055700064 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:18.108825922 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:18.641071081 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:18.656634092 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:18.656634092 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:18.801496983 CET	8080	50003	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:18.817508936 CET	465	50005	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:18.817562103 CET	5651	50004	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:19.071800947 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:19.124490976 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:20.086328030 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:20.140058994 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:21.102138042 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:21.155788898 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:22.118015051 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:22.171335936 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:23.133380890 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:23.186969042 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:24.133832932 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:24.187015057 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:25.150171041 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:25.202569962 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:25.567137957 CET	8080	50003	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:25.567284107 CET	50003	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:25.591912031 CET	5651	50004	78.138.9.142	192.168.2.4
Dec 3, 2024 09:01:25.591972113 CET	50004	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 09:01:25.598269939 CET	465	50005	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:25.598335981 CET	50005	465	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:26.164489985 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:26.218199015 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:27.180465937 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:27.233823061 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:28.195723057 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:28.249459028 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:29.212064981 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:29.265085936 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:30.220460892 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:30.265218019 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:31.227135897 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:31.281332970 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:32.242937088 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:32.296454906 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:33.258817911 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:33.311974049 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:34.273956060 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:34.327651024 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:35.293709993 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:35.343235970 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:36.305367947 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:36.358855009 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:37.321125984 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:37.374492884 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:38.336729050 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:38.390150070 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:39.352885008 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:39.405747890 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:40.368140936 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:40.421355009 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:40.880897999 CET	5655	49809	77.223.124.212	192.168.2.4
Dec 3, 2024 09:01:40.921488047 CET	49809	5655	192.168.2.4	77.223.124.212
Dec 3, 2024 09:01:41.383547068 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:41.437041044 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:42.399019003 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:42.452632904 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:43.414906979 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:43.468251944 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:44.430483103 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:44.484025955 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:45.430768967 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:45.483902931 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:46.446151018 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:46.499490023 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:47.462019920 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:47.515132904 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:48.478281021 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:48.530770063 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:49.492974043 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:49.546371937 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:50.508657932 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:50.562002897 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:51.508786917 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:51.562006950 CET	49874	80	192.168.2.4	111.90.147.125
Dec 3, 2024 09:01:52.525522947 CET	80	49874	111.90.147.125	192.168.2.4
Dec 3, 2024 09:01:52.577637911 CET	49874	80	192.168.2.4	111.90.147.125

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 08:59:09.750004053 CET	61966	53	192.168.2.4	1.1.1.1
Dec 3, 2024 08:59:10.149921894 CET	53	61966	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 08:59:09.750004053 CET	192.168.2.4	1.1.1.1	0xd549	Standard query (0)	id72.internetid.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 08:58:49.112268925 CET	1.1.1.1	192.168.2.4	0xa46a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:58:49.112268925 CET	1.1.1.1	192.168.2.4	0xa46a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:58:59.651021004 CET	1.1.1.1	192.168.2.4	0xee5	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 08:59:06.456948996 CET	1.1.1.1	192.168.2.4	0xf067	No error (0)	prod.globalsign.map.fastly.net		151.101.2.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:59:06.456948996 CET	1.1.1.1	192.168.2.4	0xf067	No error (0)	prod.globalsign.map.fastly.net		151.101.130.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:59:06.456948996 CET	1.1.1.1	192.168.2.4	0xf067	No error (0)	prod.globalsign.map.fastly.net		151.101.194.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:59:06.456948996 CET	1.1.1.1	192.168.2.4	0xf067	No error (0)	prod.globalsign.map.fastly.net		151.101.66.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 08:59:10.149921894 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	id72.internetid.ru	main.internetid.ru		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 08:59:10.149921894 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	main.internetid.ru		95.213.205.83	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49874	111.90.147.125	80	8104	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 09:00:03.640391111 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Dec 3, 2024 09:00:03.640410900 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Dec 3, 2024 09:00:05.231409073 CET	4	IN	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 09:00:05.231710911 CET	6	OUT	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 09:00:05.231734037 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 3, 2024 09:00:05.231740952 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Dec 3, 2024 09:00:05.231762886 CET	6	OUT	Data Raw: 00 00 00 2e Data Ascii: .
Dec 3, 2024 09:00:05.231771946 CET	46	OUT	Data Raw: 22 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 20 00 6e 00 61 00 6d 00 65 00 3a 00 20 00 34 00 39 00 34 00 31 00 32 00 36 00 22 00 Data Ascii: "Computer name: 494126"
Dec 3, 2024 09:00:06.067918062 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:
Dec 3, 2024 09:00:07.071435928 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	02:58:37
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\442.docx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\442.docx.exe"
Imagebase:	0x7ff6e9960000
File size:	25'141'051 bytes
MD5 hash:	FB8117B1A3F0924100FBC209DBBB1BB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:58:39
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Imagebase:	0x7ff7673d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:58:40
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7673d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:58:40
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Imagebase:	0xa60000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:58:41
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 27EB6A3C3744FE0C3070BA0974142203
Imagebase:	0xcb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:58:42
Start date:	03/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff735860000
File size:	4'630'384 bytes
MD5 hash:	320823F03672CEB82CC3A169989ABD12
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:58:43
Start date:	03/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:58:49
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Imagebase:	0xf50000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000A.00000000.1833112802.0000000001A05000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:58:53
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Imagebase:	0xea0000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000C.00000000.1886249822.0000000002361000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:58:58
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0xea0000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:59:00
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Imagebase:	0xea0000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:59:01
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Imagebase:	0xea0000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000011.00000002.3583938234.0000000002AD8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000011.00000003.2017043262.0000000005748000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:59:03
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Imagebase:	0xf50000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3578746166.000000000351A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3578746166.00000000034F6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	02:59:03
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0xf50000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3578843843.000000000348A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3578843843.0000000003458000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3584056287.0000000004DC4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000013.00000002.3584056287.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	02:59:12
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0xf50000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:59:52
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0xea0000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF6E998B190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E996255C: GetDlgItem.USER32 ref: 00007FF6E99625AC
Part of subcall function 00007FF6E996255C: SetWindowTextW.USER32 ref: 00007FF6E99625C8

EndDialog.USER32 ref: 00007FF6E998B2D0
SetDlgItemTextW.USER32 ref: 00007FF6E998B320
GetMessageW.USER32 ref: 00007FF6E998B350
IsDialogMessageW.USER32 ref: 00007FF6E998B369
TranslateMessage.USER32 ref: 00007FF6E998B37B
DispatchMessageW.USER32 ref: 00007FF6E998B389
EndDialog.USER32 ref: 00007FF6E998B3D3
GetDlgItem.USER32 ref: 00007FF6E998B410
SendMessageW.USER32 ref: 00007FF6E998B431
SendMessageW.USER32 ref: 00007FF6E998B449
SetFocus.USER32 ref: 00007FF6E998B452
GetLastError.KERNEL32 ref: 00007FF6E998B634
GetLastError.KERNEL32 ref: 00007FF6E998B665
GetTickCount.KERNEL32 ref: 00007FF6E998B68B
GetLastError.KERNEL32 ref: 00007FF6E998B6F5
GetCommandLineW.KERNEL32 ref: 00007FF6E998B841
CreateFileMappingW.KERNEL32 ref: 00007FF6E998B900
MapViewOfFile.KERNEL32 ref: 00007FF6E998B923
Sleep.KERNEL32 ref: 00007FF6E998B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF6E998B9DF
CloseHandle.KERNEL32 ref: 00007FF6E998B9E8
SetDlgItemTextW.USER32 ref: 00007FF6E998BCDE
DialogBoxParamW.USER32 ref: 00007FF6E998C0D7
EndDialog.USER32 ref: 00007FF6E998C0EF
EnableWindow.USER32 ref: 00007FF6E998C2A6
SendMessageW.USER32 ref: 00007FF6E998C2F8
ShellExecuteExW.SHELL32 ref: 00007FF6E998B95B

Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB67
Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB80

SendMessageW.USER32 ref: 00007FF6E998BEC3
SendDlgItemMessageW.USER32 ref: 00007FF6E998BEEA
GetDlgItem.USER32 ref: 00007FF6E998BEF8
SendMessageW.USER32 ref: 00007FF6E998BF12
GetDlgItem.USER32 ref: 00007FF6E998BF4F
SetDlgItemTextW.USER32 ref: 00007FF6E998BFEC
SetDlgItemTextW.USER32 ref: 00007FF6E998C004
SetDlgItemTextW.USER32 ref: 00007FF6E998C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998C381
SendDlgItemMessageW.USER32 ref: 00007FF6E998C449
EndDialog.USER32 ref: 00007FF6E998C463
GetDlgItem.USER32 ref: 00007FF6E998C491
SetFocus.USER32 ref: 00007FF6E998C49A
SendDlgItemMessageW.USER32 ref: 00007FF6E998C53E
FindFirstFileW.KERNEL32 ref: 00007FF6E998C562
FindClose.KERNEL32 ref: 00007FF6E998C68A
SendDlgItemMessageW.USER32 ref: 00007FF6E998C7AF

Part of subcall function 00007FF6E996129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9961396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998CAC7

Strings

REPLACEFILEDLG, xrefs: 00007FF6E998C3D3
STARTDLG, xrefs: 00007FF6E998B1CA
p, xrefs: 00007FF6E998B7AB
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6E998B799
LICENSEDLG, xrefs: 00007FF6E998C0C9
@, xrefs: 00007FF6E998B7B6
winrarsfxmappingfile.tmp, xrefs: 00007FF6E998B8E0
%s %s, xrefs: 00007FF6E998C6D9, 00007FF6E998C946
__tmp_rar_sfx_access_check_, xrefs: 00007FF6E998B6A9
runas, xrefs: 00007FF6E998B7C9

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 3e6d9a693a79c7c9cf2c1e4f069a4971a6be31a9e2dbb94d55183296269d1cf4
Instruction ID: 574e860ef1b287aed9e3fc1d2fa2761eca83ffbfb68b563b3c6a415c2ea82650
Opcode Fuzzy Hash: 3e6d9a693a79c7c9cf2c1e4f069a4971a6be31a9e2dbb94d55183296269d1cf4
Instruction Fuzzy Hash: 3FD2D163A1868295FB249F25E8443F96361EF85780F484136D94DCBAE7EF3EE544C30A

Function 00007FF6E998CE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6E998D5F3
SendMessageW.USER32 ref: 00007FF6E998D626
SendMessageW.USER32 ref: 00007FF6E998D655
MoveFileW.KERNEL32 ref: 00007FF6E998DB4B
MoveFileExW.KERNEL32 ref: 00007FF6E998DB69
GetTempPathW.KERNEL32 ref: 00007FF6E998DC49

Part of subcall function 00007FF6E9961FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961FFB

EndDialog.USER32 ref: 00007FF6E998DFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E998EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E998EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E998EF73

Strings

MAX, xrefs: 00007FF6E998EA82, 00007FF6E998EA91
@set:user, xrefs: 00007FF6E998DD96, 00007FF6E998DDA5
MIN, xrefs: 00007FF6E998EAE5, 00007FF6E998EAF4
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6E998D501
HIDE, xrefs: 00007FF6E998E9E5, 00007FF6E998E9F4
.tmp, xrefs: 00007FF6E998DA85
<br>, xrefs: 00007FF6E998D6DA, 00007FF6E998D6E9
lnk, xrefs: 00007FF6E998E3CA, 00007FF6E998E3D9
.lnk, xrefs: 00007FF6E998E406, 00007FF6E998E415
ProgramFilesDir, xrefs: 00007FF6E998D4F0

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 6ebf391096c313739f4001c1e8d4f8bb144ce40d1e5a517d741761108fe7ef46
Instruction ID: 25aa7d3a309fab7ef08d25489969097b1f0075341e0e621b51fa4ae80839210e
Opcode Fuzzy Hash: 6ebf391096c313739f4001c1e8d4f8bb144ce40d1e5a517d741761108fe7ef46
Instruction Fuzzy Hash: E213AF23A14B8299EB24DF74D8503EC27A1EF40398F580539DA1D97ADBDF3AE584C349

Function 00007FF6E9990754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E997DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E018
Part of subcall function 00007FF6E997DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E030
Part of subcall function 00007FF6E997DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E05D

Part of subcall function 00007FF6E99762DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E99762F2
Part of subcall function 00007FF6E99762DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E997632C

Part of subcall function 00007FF6E998946C: OleInitialize.OLE32 ref: 00007FF6E9989486
Part of subcall function 00007FF6E998946C: SHGetMalloc.SHELL32 ref: 00007FF6E99894D4

GetCommandLineW.KERNEL32 ref: 00007FF6E999096E
OpenFileMappingW.KERNEL32 ref: 00007FF6E9990A07
MapViewOfFile.KERNEL32 ref: 00007FF6E9990A30
UnmapViewOfFile.KERNEL32 ref: 00007FF6E9990A46
MapViewOfFile.KERNEL32 ref: 00007FF6E9990A63
UnmapViewOfFile.KERNEL32 ref: 00007FF6E9990ACA
CloseHandle.KERNEL32 ref: 00007FF6E9990AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E9990BAD
GetLocalTime.KERNEL32 ref: 00007FF6E9990BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E9990C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E9990C26
GetModuleHandleW.KERNEL32 ref: 00007FF6E9990C2E
LoadIconW.USER32 ref: 00007FF6E9990C4D
DialogBoxParamW.USER32 ref: 00007FF6E9990CB6
Sleep.KERNEL32 ref: 00007FF6E9990CE6
DeleteObject.GDI32 ref: 00007FF6E9990D0D
DeleteObject.GDI32 ref: 00007FF6E9990D1F
CloseHandle.KERNEL32 ref: 00007FF6E9990D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9990DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9990DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9990DE3

Part of subcall function 00007FF6E998FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E998FD43
Part of subcall function 00007FF6E998FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E998FDBC

Strings

sfxstime, xrefs: 00007FF6E9990C1F
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6E9990C02
STARTDLG, xrefs: 00007FF6E9990CA5
sfxname, xrefs: 00007FF6E9990B9B
winrarsfxmappingfile.tmp, xrefs: 00007FF6E99909F9

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: c5916489d6819e2517ae573ce65b4a279a224d0388b5e67202a83574e880266c
Instruction ID: 7660790a9cb071b6bba680e01c54d97a7f9a44f096a80051c1410704bd8168ea
Opcode Fuzzy Hash: c5916489d6819e2517ae573ce65b4a279a224d0388b5e67202a83574e880266c
Instruction Fuzzy Hash: B9129963E18B8286FB109F25E8453BD6361FF84784F484235DA5D86AA7DF7EE140C34A

Function 00007FF6E997A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E997A504

Part of subcall function 00007FF6E9980F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6E9980F99

SetDlgItemTextW.USER32 ref: 00007FF6E997A573
GetWindowRect.USER32 ref: 00007FF6E997A5AD
GetClientRect.USER32 ref: 00007FF6E997A5BB
GetWindowLongPtrW.USER32 ref: 00007FF6E997A66C
GetWindowRect.USER32 ref: 00007FF6E997A6B2
SetWindowTextW.USER32 ref: 00007FF6E997A6EC
GetSystemMetrics.USER32 ref: 00007FF6E997A6F7
GetWindow.USER32 ref: 00007FF6E997A708
GetWindowRect.USER32 ref: 00007FF6E997A746
GetWindow.USER32 ref: 00007FF6E997A808

Strings

CAPTION, xrefs: 00007FF6E997A6CF
$%s:, xrefs: 00007FF6E997A4EF

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 81d8169b616d919e3ebd223ce1795772df4fda92414e9cd0dc5ddca472b356de
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 5491D633B1864186E714CF79A80076AA7A1FF84784F485535EE4E8BB99DF3DE805CB04

Function 00007FF6E9988624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF6E998863D
SizeofResource.KERNEL32 ref: 00007FF6E9988659
LoadResource.KERNEL32 ref: 00007FF6E9988673
LockResource.KERNEL32 ref: 00007FF6E9988685
GlobalAlloc.KERNELBASE ref: 00007FF6E99886A6
GlobalLock.KERNEL32 ref: 00007FF6E99886BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF6E99886E8
GdipAlloc.GDIPLUS ref: 00007FF6E99886FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6E9988769
GlobalUnlock.KERNEL32 ref: 00007FF6E998878C
GlobalFree.KERNEL32 ref: 00007FF6E9988795

Strings

PNG, xrefs: 00007FF6E998862F

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: d7149b5c138a2508451fd25a2429f87ef968f6b0690b5fc840f63f8b529ed8c2
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 20411F26E09A0281EF189F17D8443B963A4EF88BD4F0C4439CD1D87366EF7EE4458716

Function 00007FF6E996F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971263

Strings

__tmp_reference_source_, xrefs: 00007FF6E996FCCF, 00007FF6E996FCDE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: f561e0e70ed0c8f261922accd0b1c0d9c667734151b31c61fa76ef6c2567ebf6
Instruction ID: 9ed6d2399738e6027c5741625e9d178528becfb6bc1539486d1ebbeadce2365f
Opcode Fuzzy Hash: f561e0e70ed0c8f261922accd0b1c0d9c667734151b31c61fa76ef6c2567ebf6
Instruction Fuzzy Hash: DEE29163A186C292EA648F25E1403BE6761FF81784F484132DB9D936E7DF3EE454C70A

Function 00007FF6E9964840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9965124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9965E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9965E1C

Strings

CMT, xrefs: 00007FF6E99659B2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 7b5fa825bd18b07956be4adf978f5c614e6a418d86798f7ae75c37915e2fc538
Instruction ID: dc23a632287b577d445aef2ba77c1e0024a83a52dd26508ae5988123ed0479b6
Opcode Fuzzy Hash: 7b5fa825bd18b07956be4adf978f5c614e6a418d86798f7ae75c37915e2fc538
Instruction Fuzzy Hash: 36E2DB33B2868286EB189F65D5903FE67A1AF45384F480035DA5E83797DF3EE054C38A

Function 00007FF6E99740BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6E997410B
FindFirstFileW.KERNELBASE ref: 00007FF6E997415E
GetLastError.KERNEL32 ref: 00007FF6E99741AF
FindNextFileW.KERNEL32 ref: 00007FF6E99741D7
GetLastError.KERNEL32 ref: 00007FF6E99741E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9974315

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: e00911ed99825cb93216281e8042c5d8089b28651dbc7c90a12e2ff066408ff5
Instruction ID: 4715500703f29ce28df8979a2a7c7c97b003a659b2299379fff441cd7388a163
Opcode Fuzzy Hash: e00911ed99825cb93216281e8042c5d8089b28651dbc7c90a12e2ff066408ff5
Instruction Fuzzy Hash: 7B61A263A18A4285EA109F29E8403BD6361FF957A4F144331EABD83BDADF3DD584C705

Function 00007FF6E9965E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6E99659B2, 00007FF6E996675B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 8928320ae6cd716fc977bb68eff86db0b2a70291441e82f998a9964a40b9c2b9
Instruction ID: e3af6fb74d721f8740b4321af8d15abbd4495fcd29780f6ebfbb4196e3c39733
Opcode Fuzzy Hash: 8928320ae6cd716fc977bb68eff86db0b2a70291441e82f998a9964a40b9c2b9
Instruction Fuzzy Hash: 0342BAA3B186829AEB189F75C1503FD67A0AF41388F480136DB5E936D7DF39E518C386

Function 00007FF6E9981F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cc9b5d49baee892d39d1da46008d2b4229947a5b0a2c39888c4d08721f4c94
Instruction ID: 13c4424c7b7914c663e350ff2db34f8a9400fcd3fe17f97e2b307c06612ff085
Opcode Fuzzy Hash: 00cc9b5d49baee892d39d1da46008d2b4229947a5b0a2c39888c4d08721f4c94
Instruction Fuzzy Hash: 8FE1B463A082828AEB78CF29A4453BD7791FF44788F094139DB4E87786DF3EE5418709

Function 00007FF6E9983484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction ID: 653dac16d66f361cd90303f368e39f1600d2b7ab3e52af41412ef7ae9915a1a8
Opcode Fuzzy Hash: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction Fuzzy Hash: 62B1CFA3B04AC992DE6CCE66D6097E9A395BB05BC4F48803ADE0D87742DF3DE155C306

Function 00007FF6E9974928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction ID: e3cef524f4bc3860a510c26a61c3707cfb015d79d4ba5233f814c76ecbe34177
Opcode Fuzzy Hash: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction Fuzzy Hash: 1741F323B1565286FA68DE22A95076A2353BFC4B88F084030DE0D877D7DF3DE4428749

Function 00007FF6E997DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E05D
CreateFileW.KERNEL32 ref: 00007FF6E997E3F0
SetFilePointer.KERNEL32 ref: 00007FF6E997E40E
ReadFile.KERNEL32 ref: 00007FF6E997E436

Part of subcall function 00007FF6E997DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6E997DDDF

CompareStringW.KERNELBASE ref: 00007FF6E997E559
CloseHandle.KERNEL32 ref: 00007FF6E997E4F3

Part of subcall function 00007FF6E9961FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961FFB

Part of subcall function 00007FF6E99751A4: GetVersionExW.KERNEL32 ref: 00007FF6E99751D5

Part of subcall function 00007FF6E997DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF6E997DEFF
Part of subcall function 00007FF6E997DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997DFB5
Part of subcall function 00007FF6E997DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997DFBB
Part of subcall function 00007FF6E997DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997DFC1
Part of subcall function 00007FF6E997DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6E997E7AA
ExitProcess.KERNEL32 ref: 00007FF6E997E7BB

Strings

slc.dll, xrefs: 00007FF6E997E23D
msasn1.dll, xrefs: 00007FF6E997E195
SSPICLI.DLL, xrefs: 00007FF6E997E09C
setupapi.dll, xrefs: 00007FF6E997E141
propsys.dll, xrefs: 00007FF6E997E2AD
ieframe.dll, xrefs: 00007FF6E997E120
wkscli.dll, xrefs: 00007FF6E997E2E5
cabinet.dll, xrefs: 00007FF6E997E1DB
SetDllDirectoryW, xrefs: 00007FF6E997E026
kernel32, xrefs: 00007FF6E997E011
clbcatq.dll, xrefs: 00007FF6E997E0E9
comres.dll, xrefs: 00007FF6E997E0F4
dwmapi.dll, xrefs: 00007FF6E997E0BD, 00007FF6E997E661
ws2help.dll, xrefs: 00007FF6E997E10A
imageres.dll, xrefs: 00007FF6E997E24B
sfc_os.dll, xrefs: 00007FF6E997E091
apphelp.dll, xrefs: 00007FF6E997E14F
dhcpcsvc.dll, xrefs: 00007FF6E997E32B
cryptsp.dll, xrefs: 00007FF6E997E355
WindowsCodecs.dll, xrefs: 00007FF6E997E213
ntmarta.dll, xrefs: 00007FF6E997E1F7
dsrole.dll, xrefs: 00007FF6E997E37F
dhcpcsvc6.dll, xrefs: 00007FF6E997E31D
shdocvw.dll, xrefs: 00007FF6E997E179
browcli.dll, xrefs: 00007FF6E997E301
ntshrui.dll, xrefs: 00007FF6E997E12B
rsaenh.dll, xrefs: 00007FF6E997E0A7
devrtl.dll, xrefs: 00007FF6E997E29F
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6E997E73B
version.dll, xrefs: 00007FF6E997E07B
lpk.dll, xrefs: 00007FF6E997E0D3
psapi.dll, xrefs: 00007FF6E997E115
secur32.dll, xrefs: 00007FF6E997E1CD
wintrust.dll, xrefs: 00007FF6E997E1B1
linkinfo.dll, xrefs: 00007FF6E997E347
dfscli.dll, xrefs: 00007FF6E997E2F3
mpr.dll, xrefs: 00007FF6E997E291
aclui.dll, xrefs: 00007FF6E997E371
uxtheme.dll, xrefs: 00007FF6E997E66D
dnsapi.DLL, xrefs: 00007FF6E997E259
UXTheme.dll, xrefs: 00007FF6E997E0B2
XmlLite.dll, xrefs: 00007FF6E997E339
srvcli.dll, xrefs: 00007FF6E997E221
atl.dll, xrefs: 00007FF6E997E136
mlang.dll, xrefs: 00007FF6E997E2BB
samlib.dll, xrefs: 00007FF6E997E2D7
oleaccrc.dll, xrefs: 00007FF6E997E1E9
samcli.dll, xrefs: 00007FF6E997E2C9
SetDefaultDllDirectories, xrefs: 00007FF6E997E053
crypt32.dll, xrefs: 00007FF6E997E187
netutils.dll, xrefs: 00007FF6E997E283
profapi.dll, xrefs: 00007FF6E997E205
rasadhlp.dll, xrefs: 00007FF6E997E30F
cscapi.dll, xrefs: 00007FF6E997E22F
iphlpapi.DLL, xrefs: 00007FF6E997E267
WINNSI.DLL, xrefs: 00007FF6E997E275
ws2_32.dll, xrefs: 00007FF6E997E0FF
cryptbase.dll, xrefs: 00007FF6E997E0C8
shell32.dll, xrefs: 00007FF6E997E1BF
RpcRtRemote.dll, xrefs: 00007FF6E997E363
cryptui.dll, xrefs: 00007FF6E997E1A3
usp10.dll, xrefs: 00007FF6E997E0DE
netapi32.dll, xrefs: 00007FF6E997E16B
peerdist.dll, xrefs: 00007FF6E997E38D
userenv.dll, xrefs: 00007FF6E997E15D
DXGIDebug.dll, xrefs: 00007FF6E997E086, 00007FF6E997E5B6

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction ID: b152ea27aa93907c04b961991bfff1e7fd25a6c92b5dc452d8fa832f6cb09626
Opcode Fuzzy Hash: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction Fuzzy Hash: 1F323D33E09B8299EB219F64E8402E933A4FF44354F580236DA4D877A6EF7ED654C349

Function 00007FF6E99798DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9978E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9978F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E9979F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997A435

Part of subcall function 00007FF6E9980BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E9980B44), ref: 00007FF6E9980BE9

Strings

RTL, xrefs: 00007FF6E9979F2E
, xrefs: 00007FF6E9979DF9
@%s:, xrefs: 00007FF6E9979F57
MENU, xrefs: 00007FF6E9979DD9
*messages***, xrefs: 00007FF6E9979C04
,, xrefs: 00007FF6E9979FAA
$%s:, xrefs: 00007FF6E9979F50
DIALOG, xrefs: 00007FF6E9979DCD
DIRECTION, xrefs: 00007FF6E9979DE5
*messages***, xrefs: 00007FF6E9979BC6
STRINGS, xrefs: 00007FF6E9979DC1

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: e9373c6c8447d3f6bd3ca8f7216f9b88ee08b61aa473e508913f217581450698
Instruction ID: 3452927f6ce313f3437538351a7aa0ea3abd02c6251890e02aa0963d64dc111a
Opcode Fuzzy Hash: e9373c6c8447d3f6bd3ca8f7216f9b88ee08b61aa473e508913f217581450698
Instruction Fuzzy Hash: BD62AF23B1AA8295EB10DF25C4443BD2365FF50788F884132EA5D8B6D6EF3EE544C34A

Function 00007FF6E9991900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E9991558: DloadProtectSection.DELAYIMP ref: 00007FF6E99915C9

RaiseException.KERNEL32 ref: 00007FF6E99919A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6E9991993

Part of subcall function 00007FF6E9991868: DloadProtectSection.DELAYIMP ref: 00007FF6E99918C7

LoadLibraryExA.KERNELBASE ref: 00007FF6E9991A46
GetLastError.KERNEL32 ref: 00007FF6E9991A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6E9991A86
RaiseException.KERNEL32 ref: 00007FF6E9991A9A

Strings

H, xrefs: 00007FF6E9991974

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 9113c2d3a20ac900f70ca7070c6cbfa0c558f84b610a099ae60fa7f013d8f05e
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 18912733E05B528AEB24CF66D8403A823B1FF08B98F494535DE0E5775AEF79A445C309

Function 00007FF6E998F4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6E998F747
ShowWindow.USER32 ref: 00007FF6E998F786
GetExitCodeProcess.KERNEL32 ref: 00007FF6E998F7BD
CloseHandle.KERNEL32 ref: 00007FF6E998F7E7
ShowWindow.USER32 ref: 00007FF6E998F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998F8FB

Strings

.exe, xrefs: 00007FF6E998F7F2
.inf, xrefs: 00007FF6E998F675
Install, xrefs: 00007FF6E998F684
p, xrefs: 00007FF6E998F529

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: ca10c692b0092673a70f825e0f7c38ef792e5221b25db3a1f8716acfce167973
Instruction ID: 9d001ccf771038aa536935d8b1f5860ffd1543e6e00583ffa9c29cef77b5701c
Opcode Fuzzy Hash: ca10c692b0092673a70f825e0f7c38ef792e5221b25db3a1f8716acfce167973
Instruction Fuzzy Hash: 75C17F63F18A0295FB24CF65D94037D23A1EF85B84F085039DA4EC76A6DF3EE495834A

Function 00007FF6E998F0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E998AE1C: PeekMessageW.USER32 ref: 00007FF6E998AE32
Part of subcall function 00007FF6E998AE1C: GetMessageW.USER32 ref: 00007FF6E998AE49
Part of subcall function 00007FF6E998AE1C: IsDialogMessageW.USER32 ref: 00007FF6E998AE60
Part of subcall function 00007FF6E998AE1C: TranslateMessage.USER32 ref: 00007FF6E998AE6F
Part of subcall function 00007FF6E998AE1C: DispatchMessageW.USER32 ref: 00007FF6E998AE7A

GetDlgItem.USER32 ref: 00007FF6E998F0E3
ShowWindow.USER32 ref: 00007FF6E998F109
SendMessageW.USER32 ref: 00007FF6E998F11E
SendMessageW.USER32 ref: 00007FF6E998F136
SendMessageW.USER32 ref: 00007FF6E998F157
SendMessageW.USER32 ref: 00007FF6E998F173
SendMessageW.USER32 ref: 00007FF6E998F1B6
SendMessageW.USER32 ref: 00007FF6E998F1D4
SendMessageW.USER32 ref: 00007FF6E998F1E8
SendMessageW.USER32 ref: 00007FF6E998F212
SendMessageW.USER32 ref: 00007FF6E998F22A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: b9e9e3dc7e4292dba3e5e70f22a2c8e94102f62ae83db57b651ef906ba709e39
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: 1A41A632B1464286F710CF71EC14BA93360EF45B98F481135DD0A4BB9ACF7EE4458759

Function 00007FF6E996EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F572

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2b7cf89fae77d1b38b76451e9b19ed7b8d05d4ba88469d1939a18fabe5b124cf
Instruction ID: b2f8cb912abf467c39d84d9ff4379986b2fe4fc946ee86bfd6e20d17b09e4368
Opcode Fuzzy Hash: 2b7cf89fae77d1b38b76451e9b19ed7b8d05d4ba88469d1939a18fabe5b124cf
Instruction Fuzzy Hash: FC12AE63B28B4185EA10CF65D4443BD2361EF457A8F440236DA5C97AEBDF3EE485C389

Function 00007FF6E99724C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6E997259B
GetLastError.KERNEL32 ref: 00007FF6E99725AE
CreateFileW.KERNEL32 ref: 00007FF6E997260E
GetLastError.KERNEL32 ref: 00007FF6E9972617
SetFileTime.KERNEL32 ref: 00007FF6E99726C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9972736

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 19081f07b04ed34faab68774849f12bc4f8b326dabedcfb758f4ed5384e6b2c2
Instruction ID: 7a8e1fcb4805bf3017cb0131499bf67f54d4802eb97ef2b452eff2f2d11b5e9e
Opcode Fuzzy Hash: 19081f07b04ed34faab68774849f12bc4f8b326dabedcfb758f4ed5384e6b2c2
Instruction Fuzzy Hash: CE61E273A1868185E7208F29E50436E67B1FB847A8F140335DFAD43ADADF7ED0548709

Function 00007FF6E998B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6E998B02A
GetObjectW.GDI32 ref: 00007FF6E998B05B
DeleteObject.GDI32 ref: 00007FF6E998B095
DeleteObject.GDI32 ref: 00007FF6E998B0C5

Part of subcall function 00007FF6E9988624: FindResourceExW.KERNELBASE ref: 00007FF6E998863D
Part of subcall function 00007FF6E9988624: SizeofResource.KERNEL32 ref: 00007FF6E9988659
Part of subcall function 00007FF6E9988624: LoadResource.KERNEL32 ref: 00007FF6E9988673
Part of subcall function 00007FF6E9988624: LockResource.KERNEL32 ref: 00007FF6E9988685
Part of subcall function 00007FF6E9988624: GlobalAlloc.KERNELBASE ref: 00007FF6E99886A6
Part of subcall function 00007FF6E9988624: GlobalLock.KERNEL32 ref: 00007FF6E99886BB
Part of subcall function 00007FF6E9988624: CreateStreamOnHGlobal.COMBASE ref: 00007FF6E99886E8
Part of subcall function 00007FF6E9988624: GdipAlloc.GDIPLUS ref: 00007FF6E99886FE
Part of subcall function 00007FF6E9988624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6E9988769
Part of subcall function 00007FF6E9988624: GlobalUnlock.KERNEL32 ref: 00007FF6E998878C
Part of subcall function 00007FF6E9988624: GlobalFree.KERNEL32 ref: 00007FF6E9988795

Strings

], xrefs: 00007FF6E998B063

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 295eff288590d9d504dead1e7f858abb2e02842624c8beb504a863e76f8195e9
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: B2116623B0D64242FA78DF63D6543795291AF88BC4F0C0038D96D87B9BDE2EE804870A

Function 00007FF6E998AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6E998AE32
GetMessageW.USER32 ref: 00007FF6E998AE49
IsDialogMessageW.USER32 ref: 00007FF6E998AE60
TranslateMessage.USER32 ref: 00007FF6E998AE6F
DispatchMessageW.USER32 ref: 00007FF6E998AE7A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 0d267bab028070c5435dc0c11a5e9eb46da57c613e7fc7efab47062cf7bc7247
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 3FF03C27B3854292FB609F60EC95B362361FFA0704F885431E54F86856DF2ED518CB09

Function 00007FF6E99891E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6E9989211
SHAutoComplete.SHLWAPI ref: 00007FF6E9989255

Part of subcall function 00007FF6E99813C4: CompareStringW.KERNEL32 ref: 00007FF6E99813E3

FindWindowExW.USER32 ref: 00007FF6E998923F

Strings

EDIT, xrefs: 00007FF6E998921B, 00007FF6E9989233

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: f0be0dcd4610b5b784fa5b8a03ab32f047eecdb831703c05d17b57f8f9d47da1
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 16018123B19A8381FB349F21EC103B66390AFA9740F4C0035C94E8A696EE2EE149C759

Function 00007FF6E9972CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6E9978C9A), ref: 00007FF6E9972D22
WriteFile.KERNEL32 ref: 00007FF6E9972D6C
WriteFile.KERNELBASE ref: 00007FF6E9972D9A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 80d679962d8da8723b1dfdab07288302c85f97641ab732a3254a9a7b380aa9c3
Instruction ID: 831d2d4f5d87af0da66e4bb85995176cef7235f5e46c7cfa840ff1efa55c0cb0
Opcode Fuzzy Hash: 80d679962d8da8723b1dfdab07288302c85f97641ab732a3254a9a7b380aa9c3
Instruction Fuzzy Hash: 92510823B2954292EB108F25D84477E2360FF54B90F181131DA0D866D2DFBED485C30A

Function 00007FF6E99903E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF6E9990556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99905C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99905C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99905CD

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 6a828e286131a032937447b27f48723e1ed6b8eb847440d2fa50bfc5554fc421
Instruction ID: bfc6e3e7fa813561913c811ade1b29e84191d37e3cdc33d928bd660b6ea144cc
Opcode Fuzzy Hash: 6a828e286131a032937447b27f48723e1ed6b8eb847440d2fa50bfc5554fc421
Instruction Fuzzy Hash: E55181A3F1465288FB049FA5D8453BD2322AF45B94F480635DA2C9ABD7DF6ED440C34A

Function 00007FF6E9973684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF6E997309D), ref: 00007FF6E99736CE
CreateDirectoryW.KERNEL32 ref: 00007FF6E9973733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6E997309D), ref: 00007FF6E9973791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99737CE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 25b09b08149b20c8b4e07bd85b1a81093c04adcd4e8e53ff44e467d12699f09b
Instruction ID: c56690e35e705f7e8a39809bd904e165b577589d507cd0351f76ae7e467fb950
Opcode Fuzzy Hash: 25b09b08149b20c8b4e07bd85b1a81093c04adcd4e8e53ff44e467d12699f09b
Instruction Fuzzy Hash: 6C31D763E1C68251EA209F25B44637D6351FF887A0F580231EE9DC37D6EF3ED455860A

Function 00007FF6E9992D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6E9992D7B

Part of subcall function 00007FF6E99927FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E999281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E9992D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E9992DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E9992E51

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 42a5cb0f224ab7a9685c36f36adb7ab9640142f1036218ad80c84ba0a48a1f04
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: D4311C23E0D2034AFA54AFA598523FD1391AF55384F4C1434D90ECB6D7DE2FA844825F

Function 00007FF6E9972320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6E9972927,?,00100000,?,00000001,00000000,00000000,?,00007FF6E99714C1), ref: 00007FF6E9972348
ReadFile.KERNELBASE ref: 00007FF6E9972367
GetLastError.KERNEL32 ref: 00007FF6E997239B
GetLastError.KERNEL32 ref: 00007FF6E99723BA

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: b922ae2cc89cce1edef0a687671fc471d39357c8e52b6f6834e0ec4ee9097609
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 55215323E2C65281EA605F11A40037D63A0FF45FA4F1C4531DA9DC66C6CFBED885877A

Function 00007FF6E997E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E997ECD8: ResetEvent.KERNEL32 ref: 00007FF6E997ECF1
Part of subcall function 00007FF6E997ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF6E997ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF6E997E974
CloseHandle.KERNELBASE ref: 00007FF6E997E993
DeleteCriticalSection.KERNEL32 ref: 00007FF6E997E9AA
CloseHandle.KERNEL32 ref: 00007FF6E997E9B7

Part of subcall function 00007FF6E997EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E997E95F,?,?,?,00007FF6E997463A,?,?,?), ref: 00007FF6E997EA63
Part of subcall function 00007FF6E997EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E997E95F,?,?,?,00007FF6E997463A,?,?,?), ref: 00007FF6E997EA6E

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 99f9bb707cacd175fe9c6cd479055767a3192a7e47404c462bf99dad7d954640
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: AD01ED37A14A9192E648DF21E5443ADA321FF84B90F084031DB6E53666CF7AE4B5C749

Function 00007FF6E997EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6E997EAE0
SetThreadPriority.KERNEL32 ref: 00007FF6E997EB36

Strings

CreateThread failed, xrefs: 00007FF6E997EAEE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 565470b4b470c1987a60527aa49d6d9069a080d048b0f167f53064841cbd1b60
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 0B118F33A18A4281EB00DF21E8413A97760FF84794F5C4131DA5E8666AEF7EE581C749

Function 00007FF6E998946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E997DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6E997DDDF

OleInitialize.OLE32 ref: 00007FF6E9989486
SHGetMalloc.SHELL32 ref: 00007FF6E99894D4

Strings

riched20.dll, xrefs: 00007FF6E9989475

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 83215e6dfd78ed5d62e48ba6c2835681bedaf87307b0584e856cb4c3d6324d26
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 72F04472618A4182EB10DF60F85436E73A0FF44754F480135E98E86756DF7DD559CB05

Function 00007FF6E998095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E998853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6E998856C

Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB67
Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB80

Part of subcall function 00007FF6E9961FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961FFB

Part of subcall function 00007FF6E996129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9961396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99901BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99901C1
SendDlgItemMessageW.USER32 ref: 00007FF6E99901F2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 8f1075e1628d8404eb0b8ff5fd078457097412357c837472e4b89e485d66000c
Instruction ID: 3530501d584b2b6c1b2372a9605fde5f6d2a13a28029a6889aecf4d30f240796
Opcode Fuzzy Hash: 8f1075e1628d8404eb0b8ff5fd078457097412357c837472e4b89e485d66000c
Instruction Fuzzy Hash: 7D51C063F156429AFB209FA5D4413FD2322AF85B88F480135DA1D9B7D7DE2DE540C389

Function 00007FF6E9972134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6E99721CF
CreateFileW.KERNEL32 ref: 00007FF6E997223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99722D8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4633aabe45209f1f9dd1ffe7955cd7619df91bc49ec48e97e2d646cf6da4e046
Instruction ID: d28cd7a96e08b2fdd68bf9730199cb64416ff0b9066c7345c2d6956bf902c7e5
Opcode Fuzzy Hash: 4633aabe45209f1f9dd1ffe7955cd7619df91bc49ec48e97e2d646cf6da4e046
Instruction Fuzzy Hash: 8241A073A1878186EA148F15E44436D63A1FF84BB4F185334DFAD43AD6CF7EE4908609

Function 00007FF6E99623F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6E996243E
GetWindowTextW.USER32 ref: 00007FF6E9962476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9962505

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 99f260cf01eacc222b7a5352e24814868a0cac877fcbd5e2c3ba6216c957fae9
Instruction ID: 408119aac525c025cb8385ca44d52ba1971f2fcb39936c08c1d21504f0a3e5e0
Opcode Fuzzy Hash: 99f260cf01eacc222b7a5352e24814868a0cac877fcbd5e2c3ba6216c957fae9
Instruction Fuzzy Hash: 55218473A28B8181EA148F65A84027EA364FF89BD0F185235EBDD43B96DF3DD150C745

Function 00007FF6E9981F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E998205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E9982077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E9982093

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 65d8091f10f06cce83768fe095ce433e052fa83f4fe25a8c85fad3cbd40ccd0d
Instruction ID: 6003930d6582d407859f8d2e26ddb76b0768017c6a8cb6bc9b16bfbf8fec1d46
Opcode Fuzzy Hash: 65d8091f10f06cce83768fe095ce433e052fa83f4fe25a8c85fad3cbd40ccd0d
Instruction Fuzzy Hash: 50318F23A1968695FB399F14E4443BD63A0FF40B84F5C4036D24C866AADF6EE946C30B

Function 00007FF6E9973D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6E99807E1), ref: 00007FF6E9973D5E
SetFileAttributesW.KERNEL32 ref: 00007FF6E9973DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9973E1A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 3b5c7dfba4016e6e243c7c3b7e225e8d3a84efcc83b0b2c8433822de01f77114
Instruction ID: ed596dff2507072305de4304063cc31e90c7f716682099a54a23fe02515b109d
Opcode Fuzzy Hash: 3b5c7dfba4016e6e243c7c3b7e225e8d3a84efcc83b0b2c8433822de01f77114
Instruction Fuzzy Hash: 4F21C863A1868282EA209F25F4453AD6361FF88B94F185230EE9D866D6EF3DD550C609

Function 00007FF6E99731BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF6E9980822), ref: 00007FF6E99731E7
DeleteFileW.KERNEL32 ref: 00007FF6E9973237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99732A1

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: efdceb5f5ffab25265e5fdcae37b3fa604f3c5543451d082f18575ff986ab35b
Instruction ID: cb166c9cfd1c94bdd9581a0304e291fedd55a3de0b6657c571aff30176b1a0e0
Opcode Fuzzy Hash: efdceb5f5ffab25265e5fdcae37b3fa604f3c5543451d082f18575ff986ab35b
Instruction Fuzzy Hash: 67217133A1878181EA108F25F44536E6360FF88BD4F545230EE9E86AEADF2ED550C749

Function 00007FF6E99732BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6E997E5B1,?,?,?,00000000,?), ref: 00007FF6E99732E7
GetFileAttributesW.KERNELBASE ref: 00007FF6E9973334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9973399

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 4ae5ded5c3556da1f0d03c02a2ab6d15854b36abb35067c68a226e6d7cfb6ad4
Instruction ID: 013bff97a7783354e30e11cbcdf012a4b96d0c6f8a7158052c0169210254c83c
Opcode Fuzzy Hash: 4ae5ded5c3556da1f0d03c02a2ab6d15854b36abb35067c68a226e6d7cfb6ad4
Instruction Fuzzy Hash: 6A217773A1868181EA109F19F44536D6361FFC8BA4F540231EAAD837D6DF3DD550C619

Function 00007FF6E999BF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6E999BF48), ref: 00007FF6E999BF8C
TerminateProcess.KERNEL32(?,?,?,00007FF6E999BF48), ref: 00007FF6E999BF97
ExitProcess.KERNEL32 ref: 00007FF6E999BFA6

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 6164b0c8ca70ac0c0ed1b6660730b3a52e39966737c30b8d00e32b0d15130dad
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 26E04F26F043054AEB546F3298953B92352AF89B42F184438D81E83397CEBFE849871A

Function 00007FF6E996F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996F89B

Part of subcall function 00007FF6E9973EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6E9980811), ref: 00007FF6E9973EFD

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 523cfcae4ce27e4da1045e17439fd3e37f9321daedba48ff7041e95377e0fec7
Instruction ID: 2e50e403f914826fd65b4db6621d4ef446bb89f4056a50c0b507c9556f1e8ffd
Opcode Fuzzy Hash: 523cfcae4ce27e4da1045e17439fd3e37f9321daedba48ff7041e95377e0fec7
Instruction Fuzzy Hash: 4D91BE73A28A8194FB10DF24D4403AD6361FF84798F884135EA4D87AEBDF7AD585C385

Function 00007FF6E9963904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9963AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9963AB9

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b7d18fcdb9ce11e94f0f8a2afa8545fe9f5a6d7038082b9b3b6f763717e9c5a1
Instruction ID: b02c23b0bcc9a66d8c3d6beece7738e074c18285c5f996618ae8c283076ce8b9
Opcode Fuzzy Hash: b7d18fcdb9ce11e94f0f8a2afa8545fe9f5a6d7038082b9b3b6f763717e9c5a1
Instruction Fuzzy Hash: 7741C063F2465288FB00DFB5D4413AD2720AF45B98F181235DE1DA7ADBDE3A9082C289

Function 00007FF6E9972778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6E997274D), ref: 00007FF6E99728A9
GetLastError.KERNEL32(?,00007FF6E997274D), ref: 00007FF6E99728B8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: b7675171b1ecc0939fc2ccbdf049726f5b42d45e2bae8c9c5a8faeaa2ab2af22
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 1B318223B29A5282FA604E2AD9407FD6390EF04BD4F1C1131DE5D877E2DEBFE4818646

Function 00007FF6E99622BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6E99622F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99623F0

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 0d2cfb920ea231b6e9d51c7db040a15a52ec3b00ba863ec475c32ede1f66f479
Instruction ID: 5d0a48a865e99a95a02097072f699e613533cdade451f65a9d0d6577c9ec9a32
Opcode Fuzzy Hash: 0d2cfb920ea231b6e9d51c7db040a15a52ec3b00ba863ec475c32ede1f66f479
Instruction Fuzzy Hash: 6E31C123A2874186EA108F15E44536E7360EF84B90F484235EB9C87B97DF3DE040C749

Function 00007FF6E9972AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6E9972AFE
SetFileTime.KERNELBASE ref: 00007FF6E9972B9B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 1cb7615cd20c710ff69fafa80b40c95b97a7587cbbba9e0e18891b82dd7b4721
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 1621B223F19B5251EA628F62E4047BE6790AF02794F1D4431DE4C462E6EE7ED586C20A

Function 00007FF6E997AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6E997AB67
LoadStringW.USER32 ref: 00007FF6E997AB80

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 169d8fd1f78cf30ac39f65ec43e0034fe22566e303df4c0336e022bc3f6591a1
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: B61149A2B0964186EA008F16AC8426977A1BF98FC0F5C4535DA0DDB762DF7DE541838E

Function 00007FF6E9972BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6E9972C11
GetLastError.KERNEL32 ref: 00007FF6E9972C1E

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: ad791548fa59e81c4491c876d2a17836f805ceddae8eddd3267700112c64cb2d
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: E6119022A2864181EB608F25E84137D6760EF55BA4F6C0331DA7D862D6DF7ED592C306

Function 00007FF6E996255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E997A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E997A504
Part of subcall function 00007FF6E997A4AC: SetDlgItemTextW.USER32 ref: 00007FF6E997A573
Part of subcall function 00007FF6E997A4AC: GetWindowRect.USER32 ref: 00007FF6E997A5AD
Part of subcall function 00007FF6E997A4AC: GetClientRect.USER32 ref: 00007FF6E997A5BB

GetDlgItem.USER32 ref: 00007FF6E99625AC
SetWindowTextW.USER32 ref: 00007FF6E99625C8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: c8601caa790491e7021f3a39f2879476d40f24db404ddd00096301e8e710c44f
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: AA015E62A2934A41FF695F52A4583795391AF85784F0C0475DC4DCA2DBDE2EE884C34E

Function 00007FF6E997EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E997EBAD,?,?,?,?,00007FF6E9975752,?,?,?,00007FF6E99756DE), ref: 00007FF6E997EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF6E997EB6F

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 0bc82184554e7b76f8f0bf40cd4323cddf41bae23aa08602f4468f4b7c098355
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: F5E02B62F1454682DF488FA7C4406E97392FFC8B40B8C8035D60BC3615EE2DE1458B05

Function 00007FF6E99921D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9992200

Part of subcall function 00007FF6E9992F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E9992F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9992206

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction ID: 46b6556415e95399ad8f0c59c6e0308b2b2d7b26a406817091ad96072fec3524
Opcode Fuzzy Hash: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction Fuzzy Hash: BEE0EC42E1A1074DFD682A6519253BC00544F29774E1C1730DA3EC82C3AD1EB4E1815A

Function 00007FF6E999D90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6E999D922
GetLastError.KERNEL32 ref: 00007FF6E999D934

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 199f550aab7959d9f626510be76cdec220346d0d4a91f9f142c10490fd9ca824
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: F6E0E662E0A6034AFF156FF258853B512D19F98751B0C5034D91DC7253DE2E9495861A

Function 00007FF6E99633E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996388C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bdaa18dae508da685624d0d3084e6df67f72227f0a50523269ad36915424c154
Instruction ID: 998ba466a34cf185390f53692de4ed2aba904522e0391e3e8a80d47e854159b3
Opcode Fuzzy Hash: bdaa18dae508da685624d0d3084e6df67f72227f0a50523269ad36915424c154
Instruction Fuzzy Hash: D2D19573B1868256EB288F2596413B96BA5FF05B84F084035CE1D877A7CF3EE460C386

Function 00007FF6E9975294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997551B

Part of subcall function 00007FF6E99813F4: CompareStringW.KERNEL32 ref: 00007FF6E998145A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fe83b5f940341ca116520553916a602459c71814f9bb651f89fc5e1609d61f08
Instruction ID: c92c0cd51b2c7dc499626fe9447bb34eaf436561748fe45c51168d367e8b99e6
Opcode Fuzzy Hash: fe83b5f940341ca116520553916a602459c71814f9bb651f89fc5e1609d61f08
Instruction Fuzzy Hash: 4A610313E0C64781FAA49F25881437E5291AF48BD4F1C4135EE4DC6AD7EE6EE880822F

Function 00007FF6E9981870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E997E948: ReleaseSemaphore.KERNEL32 ref: 00007FF6E997E974
Part of subcall function 00007FF6E997E948: CloseHandle.KERNELBASE ref: 00007FF6E997E993
Part of subcall function 00007FF6E997E948: DeleteCriticalSection.KERNEL32 ref: 00007FF6E997E9AA
Part of subcall function 00007FF6E997E948: CloseHandle.KERNEL32 ref: 00007FF6E997E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9981ACB

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 7505b5341520eded39e51a109fac183586022765dd0b74e91cbb46e86dd1eeb5
Instruction ID: f9937d52243ab067085f4457a50a7997d21c00f84ac248a9d1ceb2c0950d558e
Opcode Fuzzy Hash: 7505b5341520eded39e51a109fac183586022765dd0b74e91cbb46e86dd1eeb5
Instruction Fuzzy Hash: E661BF63B16A85A6EE2CCF65D5542BC7365FF40F90B184536E72D87AC3CF2AE4608309

Function 00007FF6E996EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996EEB8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2bd8eecad87c1f819bb1df95e90c6055fb2d52ef6a4826594ea1222993916d26
Instruction ID: f066a8ed6f3bbb7e5dde4ebacbd8a366cd69ff0e4178546515dccdf574c0750a
Opcode Fuzzy Hash: 2bd8eecad87c1f819bb1df95e90c6055fb2d52ef6a4826594ea1222993916d26
Instruction Fuzzy Hash: 5151FF63A1868281EA119F65A4453AD2751EF95BC4F4C0132EE8D873D7CE3EE4A5C389

Function 00007FF6E996E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9973EC8: FindClose.KERNELBASE(?,?,00000000,00007FF6E9980811), ref: 00007FF6E9973EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996E993

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 01fc3a34611ceffdc41415965cd615ee03a8df2eb66c7c19820eeaa0a49a7534
Instruction ID: f8d543dfa78586308597b650320284009d6c5bd75642e767a7e1eb8408474b22
Opcode Fuzzy Hash: 01fc3a34611ceffdc41415965cd615ee03a8df2eb66c7c19820eeaa0a49a7534
Instruction Fuzzy Hash: 62518123A2868681FB608F65E44537D2361FF85BC4F480132EA4D876A7DF2ED451C35A

Function 00007FF6E9971794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997187D

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 50c7f6866f78bc555d00c39fbf85de59e47fa009de7d1ee3a17a4bb0e61fbff3
Instruction ID: e8df98514cf1d402ef36b5be74dedf86fd2e751c92c2f0eebaebb3cdcf8db33e
Opcode Fuzzy Hash: 50c7f6866f78bc555d00c39fbf85de59e47fa009de7d1ee3a17a4bb0e61fbff3
Instruction Fuzzy Hash: 4141D763B18A8142EA249E17A6403B9A251FF84FC0F4C8535EE4C87F9BDF3DD4928304

Function 00007FF6E9972F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99730C8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 628d8687d64302939e4d23947fbdc881fe9b8ad1275f709a097da27502e78629
Instruction ID: b6eb78918eddf920c6f1ceb69ac72a2a3621669c62e05238dc0abbfa63299b6e
Opcode Fuzzy Hash: 628d8687d64302939e4d23947fbdc881fe9b8ad1275f709a097da27502e78629
Instruction Fuzzy Hash: 0F41D063A18B0280EE149F29E54637D23A1EF85BD8F181134EE5D876EBDF3EE450C649

Function 00007FF6E999BDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E999BE20

Part of subcall function 00007FF6E999BFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF6E999BFD0
Part of subcall function 00007FF6E999BFB0: GetProcAddress.KERNEL32 ref: 00007FF6E999BFE6
Part of subcall function 00007FF6E999BFB0: FreeLibrary.KERNEL32 ref: 00007FF6E999C00B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 354462c13aec376d095b614316c43b207629cfa89ce2735bdb21e4dca598b337
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 0141D423E186168BFB549F5298503782261EF64B84F4C4436DA0DC76A3DF7FE841C78A

Function 00007FF6E996129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9961396

Part of subcall function 00007FF6E9961F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E9961F89

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction ID: 7ac7079b1910ca036b14a1793618faa6895a2686292f089471f4cdebfd2c909c
Opcode Fuzzy Hash: 8615e64c65e08c4765cb9fe696173ca1d24e70e0804716bd186f62c3c2783a0a
Instruction Fuzzy Hash: BF217C23A1975185EA249E92A5003796250AF04BF0F6C0B35DE7E87BD3DE7EE051C38A

Function 00007FF6E9962C54 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9962D77

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: fb840d9647ab0cc3a78d99d275da67472287db788fd11e61fb78e56b1f0afad7
Instruction ID: 13eaf68aaad7f278f22e46c53a87286806a7f3cbf95f944bad92c32430af055d
Opcode Fuzzy Hash: fb840d9647ab0cc3a78d99d275da67472287db788fd11e61fb78e56b1f0afad7
Instruction Fuzzy Hash: 33214C23B28586A2EA08DF21D5553FC6324FF45784F984431E71D876A3CF7EA4A4C34A

Function 00007FF6E99A124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E99A1280

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: d9cfec5375a48c364b99159a402b8dbb4ebbc9ab7d3e80eb6b2e5c297e58f0dd
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 98114C33E1C642C6F7209F51A880779A6A5FF40388F5D0935EA8DC7697DF6EE850870A

Function 00007FF6E998FC68 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E998F0A4: GetDlgItem.USER32 ref: 00007FF6E998F0E3
Part of subcall function 00007FF6E998F0A4: ShowWindow.USER32 ref: 00007FF6E998F109
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F11E
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F136
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F157
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F173
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F1B6
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F1D4
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F1E8
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F212
Part of subcall function 00007FF6E998F0A4: SendMessageW.USER32 ref: 00007FF6E998F22A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998FD03

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: MessageSend$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1587882848-0
Opcode ID: 63eea4653700729b6f0165d399898a2d854dc8dec5165f17967af7d1785d552d
Instruction ID: ae4dff5fac8190239ea3cb7ac3b482911529d677b6f74f30487b4bcd5bc0511a
Opcode Fuzzy Hash: 63eea4653700729b6f0165d399898a2d854dc8dec5165f17967af7d1785d552d
Instruction Fuzzy Hash: 85012663A2868542ED249F25D04A37E6311EFC9794F141335EB9C8ABDBEF2DE180C609

Function 00007FF6E9963AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9963B6C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 69957ef0d3d2f58a7dead33f72e43e67ea7fb9c623eb1e5576ce27618050ff46
Instruction ID: 3d5e487bc095b6f6098d63d3727ac9777c2c86f29f9a930b30c92d4ef933d7a9
Opcode Fuzzy Hash: 69957ef0d3d2f58a7dead33f72e43e67ea7fb9c623eb1e5576ce27618050ff46
Instruction Fuzzy Hash: D401C463E2868541EA119F29E44637D7361FFC97A0F885231EA9C47AA7DF2ED040C74D

Function 00007FF6E9991558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6E9991604: GetModuleHandleW.KERNEL32(?,?,?,00007FF6E9991573,?,?,?,00007FF6E999192A), ref: 00007FF6E999162B

DloadProtectSection.DELAYIMP ref: 00007FF6E99915C9

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: 5956adb56aab8a42a7ac978f01c3317159aa4aec95c21692f5889c2383945ef3
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: 5311BA63D0C64785FB659F06AC403B023A0BF58349F5E0074C90DCA2A3EEBEB895861B

Function 00007FF6E9973EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E99740BC: FindFirstFileW.KERNELBASE ref: 00007FF6E997410B
Part of subcall function 00007FF6E99740BC: FindFirstFileW.KERNELBASE ref: 00007FF6E997415E
Part of subcall function 00007FF6E99740BC: GetLastError.KERNEL32 ref: 00007FF6E99741AF

FindClose.KERNELBASE(?,?,00000000,00007FF6E9980811), ref: 00007FF6E9973EFD

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 3e32efc9407972aa5794498430e12f8902f413cc06fe903c9e143b226ae361c1
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: FFF08163A0824285EA109F75A5023B937609F15BB4F581334EE3D472C7CE2AD454875A

Function 00007FF6E997273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6E9972755

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: 89de7a1a3181a0621853d4b86904151adb4d54531605d8195e1de3f06e479875
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: 10E08C23E2052582EB24AF2BCC427A85360EF88B85F4C1030CE0C87362CE2ED4918A09

Function 00007FF6E9972490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6E99724A2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 87e67d3078c22303132aabebf6329bd24fa293982792df299198f85366d62634
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 9FD02223D0980083DD008B36988217C2320AF86334FA80330C23EC12E3CE5E9096A30A

Function 00007FF6E9977FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6E9977FD2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 35472ba7ada17a354928cbe4b761dd936a61a6525932e63c4e1f7449fcc2b112
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 84C08C22F05502C1DA085F26CCC926813A4FF40B04B684034C10CC1160CE2EC8FA934E

Function 00007FF6E999FA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6E999FA59

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 9430948c5c5a21012ab63d9e6dcc033b5676e5385707c3732a244c37113f05cc
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 3AF04452B0A6074DFE545F6699513B492949F88B84F4C5430C90ECA3C3FE2EEAC1422A

Function 00007FF6E999D94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6E999D98A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 8dbd2820c39a563068eae91f1c7bbd0a71991b27ff56b87edbbb038d8c469af9
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: D0F05817F0A34748FF166FBA58803B416905F847A2F4C1630E92EC73C3DE2EA480821A

Function 00007FF6E99720D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6E997207E), ref: 00007FF6E99720F6

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 584719a17dd3c783d44704f1565266e099e9880537942e8b1af720c14c98f1c6
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: C6F08C23A1868285FF248F20E4413B926A0EF14BB8F5D4334D73C851D6DE69D8D5830A

Non-executed Functions

Function 00007FF6E996C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E996DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6E996CF4B), ref: 00007FF6E996DE27
Part of subcall function 00007FF6E996DE04: GetLastError.KERNEL32 ref: 00007FF6E996DE88
Part of subcall function 00007FF6E996DE04: CloseHandle.KERNEL32 ref: 00007FF6E996DE9B

wcscpy.LIBCMT ref: 00007FF6E996CBC8
wcscpy.LIBCMT ref: 00007FF6E996CBFE
CreateFileW.KERNEL32 ref: 00007FF6E996CC38
DeviceIoControl.KERNEL32 ref: 00007FF6E996CD01
CloseHandle.KERNEL32 ref: 00007FF6E996CD12
GetLastError.KERNEL32 ref: 00007FF6E996CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF6E996CD7D
DeleteFileW.KERNEL32 ref: 00007FF6E996CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996CED7

Strings

UNC\, xrefs: 00007FF6E996C53F, 00007FF6E996C55D
SeRestorePrivilege, xrefs: 00007FF6E996C343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6E996C34F
\??\, xrefs: 00007FF6E996C392, 00007FF6E996C3B8

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 617167dcf46b11c562794b4ee206f141bcd85eb54b840ba4594782cdbbce52c8
Instruction ID: 5b369dbca8951f7b8fa1cc2ae32ad0d97b08b86cc279344daf1fe60c249dc645
Opcode Fuzzy Hash: 617167dcf46b11c562794b4ee206f141bcd85eb54b840ba4594782cdbbce52c8
Instruction Fuzzy Hash: 8762AE63F2864285FB009F75D4443AD2361EF857A8F584231EA6C97ADBEE3DE184C349

Function 00007FF6E997F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6E9980528

Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB67
Part of subcall function 00007FF6E997AAE0: LoadStringW.USER32 ref: 00007FF6E997AB80

Part of subcall function 00007FF6E998B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6E9980429), ref: 00007FF6E998B110
Part of subcall function 00007FF6E998B0DC: SetLastError.KERNEL32 ref: 00007FF6E998B153

Part of subcall function 00007FF6E996129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9961396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9980490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9980496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99804F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9980532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9980538

Strings

%ls, xrefs: 00007FF6E997F3AC, 00007FF6E997F3FF
%s: %s, xrefs: 00007FF6E997FC11

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 76a0abb78ac0473acb837b08a420a3aaff51d3c31d4af88306e7b82622e5a8c2
Instruction ID: 901f6baa1a26bfa5b2ee12d812a3022078e88ed1525a70011dc3ec2ccbcb4c68
Opcode Fuzzy Hash: 76a0abb78ac0473acb837b08a420a3aaff51d3c31d4af88306e7b82622e5a8c2
Instruction Fuzzy Hash: 5FB2C963A5868241EA249F26D4553BE6311FFC97D0F184336E69D87BEBEE2DD140C30A

Function 00007FF6E99A2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E99A2C12
memcpy_s.LIBCMT ref: 00007FF6E99A35BF
memcpy_s.LIBCMT ref: 00007FF6E99A3666

Part of subcall function 00007FF6E99A38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E99A38EE

memcpy_s.LIBCMT ref: 00007FF6E99A372F

Part of subcall function 00007FF6E999D008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999D02D

Strings

1#SNAN, xrefs: 00007FF6E99A37C9
1#IND, xrefs: 00007FF6E99A37AA
1#QNAN, xrefs: 00007FF6E99A37E8
1#INF, xrefs: 00007FF6E99A3807

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: a9a5d9635e0aaba91ca585b4b5fbdeb036ec1214d2b9789f05031d403d60861a
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: D3B2F373E082828BE7258E69D4417FD37A1FF84788F185135DE0A97B86DF7AE9048B05

Function 00007FF6E9971A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6E9971A97
GetLongPathNameW.KERNEL32 ref: 00007FF6E9971AE0
GetShortPathNameW.KERNEL32 ref: 00007FF6E9971B21
GetShortPathNameW.KERNEL32 ref: 00007FF6E9971B6A

Part of subcall function 00007FF6E99813C4: CompareStringW.KERNEL32 ref: 00007FF6E99813E3

MoveFileW.KERNEL32 ref: 00007FF6E9971DFE
MoveFileW.KERNEL32 ref: 00007FF6E9971E65

Part of subcall function 00007FF6E9972134: CreateFileW.KERNEL32 ref: 00007FF6E997223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9971FED

Strings

rtmp, xrefs: 00007FF6E9971CF4, 00007FF6E9971D03

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: daf468590969a9bb0c1bd78ae2e53dc7e5858e179e50b5fea0acf6ddbd62b289
Instruction ID: f71388146d112e55f192c019389c01975871729a5a9c95ade1ca97ea1ef6d076
Opcode Fuzzy Hash: daf468590969a9bb0c1bd78ae2e53dc7e5858e179e50b5fea0acf6ddbd62b289
Instruction Fuzzy Hash: 18F1D023B18A4286EB20CF65D4802FD6761FF95784F580532EA4D83AEADF3DE584C749

Function 00007FF6E9975B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6E9975BC2
GetFullPathNameW.KERNEL32 ref: 00007FF6E9975C0E
GetFullPathNameW.KERNEL32 ref: 00007FF6E9975D2B
GetFullPathNameW.KERNEL32 ref: 00007FF6E9975D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9975EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9975EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9975EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9975EF2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: eb320a448f2f5b685a05a21c57fd524cc8e4434a836e962e5226f9c8e5b08568
Instruction ID: 95e0d0342509a77ac6999d06a41ecdd6188da9a05b52f55b4d60dbe01c7eb935
Opcode Fuzzy Hash: eb320a448f2f5b685a05a21c57fd524cc8e4434a836e962e5226f9c8e5b08568
Instruction Fuzzy Hash: 36A1A363F14A5184FE508F7998443BC2321AF95BE4B184235DE2D97BDADE3EE081C20A

Function 00007FF6E9993170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E999318C
RtlCaptureContext.KERNEL32 ref: 00007FF6E99931B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E99931D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E9993214
IsDebuggerPresent.KERNEL32 ref: 00007FF6E9993268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E9993289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E9993294

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: aa7249711d6641ca1fba554cffdb0658ddbb8daf52ba1751b0dace908400706a
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: B7316E73A08B818AEB608F65E8503ED7360FF84748F48443ADA4D87A99DF7DD548C715

Function 00007FF6E99976D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6E9997751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E9997769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E99977A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6E99977DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E99977E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E99977F2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 9bb5e4eda408b3f1a6dadc0dd4fef24c3cfd92c234ccc2e36725e8c23dd24aad
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 7C316D33A08B8199EB608F25E8403EE73A4FB84758F580135EA9D83B9ADF3DC555CB05

Function 00007FF6E9961AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9961EBB

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9edba9425319f61c263b429ec5f6a673cda7c500d94d2f9d5135e37ac7397f0d
Instruction ID: c7fa3183c60d0c5dc0c4d69ce230d6ba2c14d73d744573d47913265051729d52
Opcode Fuzzy Hash: 9edba9425319f61c263b429ec5f6a673cda7c500d94d2f9d5135e37ac7397f0d
Instruction Fuzzy Hash: 63B1D063B2468686EB209F65D8443ED2361FF85784F485232EA4D87B9BDF3DE540C349

Function 00007FF6E999FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999FAC4

Part of subcall function 00007FF6E9997934: GetCurrentProcess.KERNEL32(00007FF6E99A0CCD), ref: 00007FF6E9997961

Strings

*?, xrefs: 00007FF6E999FAEB
., xrefs: 00007FF6E999FEE4

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 773e4d2fee3fe7b2da891f6ad0a005cffd626149d2dfff71bf0d196c9ef983e8
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 36510563B15B9549EF10DFA298102B8A7A4FF48BD8B488131DE1D57B86EE3ED4828305

Function 00007FF6E99A2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6E99A210B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 3ed9a76db44e7931fdc88097d2fd5043941f95be7a0b4abeb948770fa1775ac3
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: D9D1A133B1868687DB24CF15A1847AEB7A1FB98784F188134DB4E97B45DE7DE8418B04

Function 00007FF6E996B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6E996BA9D), ref: 00007FF6E996B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6E996BA9D), ref: 00007FF6E996B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6E996BA9D), ref: 00007FF6E996B743

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: e13a8fd8ed58427aafde87f43e3fdb7609ccc3149944bfd8fd9893568025097d
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 1401FF72A1C74282E7109F26B8502BEA3A5FF89BC1F4C4034EA9E87B46DE3DD515C749

Function 00007FF6E999FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6E999FEE4

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 005ffdd755c51ea2d8f6bd9ef098a5439e31e9fc16e711fdedf0010ac3fadb50
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: A4312A23B0869149F7208E6698057B9BA91EF58BE4F0C8234DE6C87BC7DE3DD9418304

Function 00007FF6E99A5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6E99A5D45
RaiseException.KERNEL32 ref: 00007FF6E99A5D56

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: f1934ad81448e93e13754b2003dd361ba15ec30fcb0fc0fc824ce91a1af0554e
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 03B16C73A10B898BEB15CF29C84636C3BB0FB44B48F198921DA5D877A9CF7AD451C706

Function 00007FF6E9988DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E99885E0: GetDC.USER32 ref: 00007FF6E99885EC
Part of subcall function 00007FF6E99885E0: GetDeviceCaps.GDI32 ref: 00007FF6E99885FD
Part of subcall function 00007FF6E99885E0: ReleaseDC.USER32 ref: 00007FF6E998860A

GetObjectW.GDI32 ref: 00007FF6E9988E48

Part of subcall function 00007FF6E99890B0: GetDC.USER32 ref: 00007FF6E99890D9
Part of subcall function 00007FF6E99890B0: GetObjectW.GDI32 ref: 00007FF6E9989107
Part of subcall function 00007FF6E99890B0: ReleaseDC.USER32 ref: 00007FF6E99891BB

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 84f508c16392e361730d2a6e160c191362c9b8872f60b1733bfbb34245295280
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 1A813633B18A0586EB24DF6AE8406AC7371FB88B88F044126DE1D97B25DF7ED545C385

Function 00007FF6E998A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6E998A315
GetNumberFormatW.KERNEL32 ref: 00007FF6E998A371

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 99e0da79e07940ea9f935b1263a2c218422957a6577b358c22f17e4a2456e28a
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 3B116D33A18B8196E7618F11E8103E97364FF88B84F884135DA4D87669EF3DD145C74A

Function 00007FF6E997126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E99724C0: CreateFileW.KERNELBASE ref: 00007FF6E997259B
Part of subcall function 00007FF6E99724C0: GetLastError.KERNEL32 ref: 00007FF6E99725AE
Part of subcall function 00007FF6E99724C0: CreateFileW.KERNEL32 ref: 00007FF6E997260E
Part of subcall function 00007FF6E99724C0: GetLastError.KERNEL32 ref: 00007FF6E9972617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99715D0

Part of subcall function 00007FF6E9973980: MoveFileW.KERNEL32 ref: 00007FF6E99739BD
Part of subcall function 00007FF6E9973980: MoveFileW.KERNEL32 ref: 00007FF6E9973A34

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 896880a4b3967c3554a0c40650d434abbdec4492289e3c73b9c9ffb2f43eb910
Instruction ID: 79be7d489bd92877c8be803188955784874d91b4d675b465632576e4b98a279a
Opcode Fuzzy Hash: 896880a4b3967c3554a0c40650d434abbdec4492289e3c73b9c9ffb2f43eb910
Instruction Fuzzy Hash: AC91AB23B28A4282EB20DF66D4443AE6361FF94BC4F484032EE0D87B96DE3ED545C359

Function 00007FF6E9974EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6E9974EE2

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: e0e0348754423f268521e988690176a4186057b69a3b911862619ebd3b068f7a
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: 5E01A273A4D98289FB718F20A8153B623919FA9305F4C0534C59C863E3CF3EA0488A1E

Function 00007FF6E9998C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6E9998DD3

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 6b967889607a55e0eae45b8badd59adfa1f2d8c26c74eff0b06d23d15d711792
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 4A81C423A181424FFBA89E2680407FD22B1EF65748F5C1539DD09D7A97CF2FE846C64A

Function 00007FF6E99989A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6E9998B3A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 654d57fbc76ebb932f5ac4b417b3b7f0105874b9ea32004bb9c34e2f8b642afc
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 7C71B263A0D2424EFA688E2B90403FD23B19F45744F1C1939DD0AC7697CE2FE846874B

Function 00007FF6E997C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF6E997C97B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 7b05cae23a4759ac599490e8453f9fb55831f8166579128d10c085a3b2b0265b
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 7451AF37B286908BD764CF25E400A9A73A5F788798F045126EF4A93B09DF39E945CF40

Function 00007FF6E999C838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6E999C874

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 2f3e1cb2669109dfeb31bbb51e0fb6be2fa00148403640e74b2fc013211a96e8
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 5D41BD63714A448AEA44CF2AE9582A973A1BB58FD0B4D9036EE0D877A5EE3DD442C344

Function 00007FF6E99A0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6E99A0D24

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: f099432d2cdb3a25483379e3fa9984fb5d669eb93c5254922cddcf23a4caa666
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: D0B09231E17A02C2EA082F126C8239422A8FF48700F999078C10C81321DE2E20A54716

Function 00007FF6E9983964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction ID: 01a41c4d64732a427155470dee98bf6e967e2775d0b4b3caee357507492f25cf
Opcode Fuzzy Hash: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction Fuzzy Hash: 7882F1A3A096C186D729CF28D4142BC7BA1EF55B88F1D813ADE4E87386DE3ED445C316

Function 00007FF6E99676C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 86f2de7b3609ae86c79f9bb7fda3a6ebd9abdbf096e3a10a7029e9dca3c5419f
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: EA626D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF6E99853F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction ID: 9b88c5f473a0674f1a5eb15277d42d8c91f6c524c5e8bba932c22090a2c2ecad
Opcode Fuzzy Hash: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction Fuzzy Hash: E08201B3A096C18AD729CE24D4447FC7B61FB55B48F08817ACA4D8778ACE3ED489C716

Function 00007FF6E997BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 91d5ce0994a0897bfd7839c438621ba1b4a4fb504f1d6368d1ce13803b7cec5a
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: B222F3B3B206508BD728CF25D89AA5E3766F798744B4B8228DF0ACB785DF39D505CB40

Function 00007FF6E9984B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 42ca3a6464d3dcefc867775ace78a46c7ab93fd80ec03e613ab99500d8a4e779
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: C232BE73A041918BE72C8F24D550BBC37A1FB54B48F098139DA4A87B8ADF3DE865C745

Function 00007FF6E9967288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 9a4de702202edd5aa9ad9e851c666bbcd2cb31580cb2626cad54da07f258e394
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: A8C19CB7B281908FE350CF7AE400A9D3BB1F39878CB559125DF59A3B09D639E645CB40

Function 00007FF6E9982D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: fe42587069cb7abbf9287378937d7c38aff1bddb9fcb43dc46b675a727928f91
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 2DA10373A0818246EB29CE24D4457BD2792EFA0784F5D4539DE4E87787CE3EE881C31A

Function 00007FF6E997AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 97f6105e89ca2439f9cce49844c2c2c5553f4c52b5e9733d503f7c051972eb9d
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: A0C10673A291E04DE302CFB5A4248FD3FF1E71E34DB4A4152EF9666B4ADA295201DF60

Function 00007FF6E996A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: b41247bdb06977f1530140d48fab01b38085a2e935869bf84b67f2b2a1976098
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: B1911063A18581A6EB11CF29D8517FD2720FF95788F481031EE4E8B78AEE3AD606C344

Function 00007FF6E997B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: dd85ac6c8c9e4962f09596ca6ace54927257501731fb850710570f987abdc26f
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 58610123B181D159EB01CF75C5006FD7BA1AB19788B4A8032DF9A97A87DE3EE106CB15

Function 00007FF6E99821D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 0b00fea54c19abe3bec77570f5c8b3e7a863bce36c46426c6ae2f987aead9f5a
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 03512473B181A14BE72C8F28D0187BD3751FB94B98F484139DB498768ADE3EE541CB05

Function 00007FF6E9982AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 05f23be52acbfd3b70b5392f6674c205ab1b2eea2fba6f9aa0efd69fff0f5100
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: C431D0B3A086814BE71CCE1ADA5137E6B91BB45380F088139DB4AC3B83DE3DE041CB11

Function 00007FF6E997DC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: 1835d2daa930af3434867d5f7f8374454b8118b8ffc3cc2784f19b6037a4618f
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: C2F0FE63F1C20342FB680828581A3391056AF11310F5C8835D25FC72C7EEAFE881110F

Function 00007FF6E9993354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 956fb34ed1754f3434947ed65cdaa0c82a839f70a697787cf458134802321bd7
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 4FA00273D4CC43E4EA448F15E86A2B02338FF50300B984031F41EC10A6EF7EA401C32A

Function 00007FF6E996D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D964

Strings

::$INDEX_ALLOCATION, xrefs: 00007FF6E996D83E
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6E996D86A
::$INDEX_ROOT, xrefs: 00007FF6E996D854
::$DATA, xrefs: 00007FF6E996D812
::$ATTRIBUTE_LIST, xrefs: 00007FF6E996D7FC
::$EA_INFORMATION, xrefs: 00007FF6E996D828
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6E996D875
::$REPARSE_POINT, xrefs: 00007FF6E996D88B
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6E996D849
::$OBJECT_ID, xrefs: 00007FF6E996D880
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6E996D85F
::$BITMAP, xrefs: 00007FF6E996D807
::$FILE_NAME, xrefs: 00007FF6E996D833
::$EA, xrefs: 00007FF6E996D81D

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: b68ecd6b6244c16b65fc59ad38e25c14473093d62c915de36f9f2bb886cd508e
Instruction ID: 108b4bad84ab4d387c6ec90f2e928fda49f7fdf723e4ba921c6db99c1499c840
Opcode Fuzzy Hash: b68ecd6b6244c16b65fc59ad38e25c14473093d62c915de36f9f2bb886cd508e
Instruction Fuzzy Hash: 8D41F836B16B0199EB008F65D8443E833B5EF08798F480136DA5C83B6AEE7ED555C389

Function 00007FF6E9992A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6E9992A26
GetModuleHandleW.KERNEL32 ref: 00007FF6E9992A33
GetModuleHandleW.KERNEL32 ref: 00007FF6E9992A48
GetProcAddress.KERNEL32 ref: 00007FF6E9992A60
GetProcAddress.KERNEL32 ref: 00007FF6E9992A73
CreateEventW.KERNEL32 ref: 00007FF6E9992A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF6E9992AEB
CloseHandle.KERNEL32 ref: 00007FF6E9992AFD

Strings

WakeAllConditionVariable, xrefs: 00007FF6E9992A66
SleepConditionVariableCS, xrefs: 00007FF6E9992A56
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6E9992A2C
kernel32.dll, xrefs: 00007FF6E9992A41

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: bc26b6b63bb2a5eab47cc9af298d9f35ea0ae387fcf4582e3a1d4511d72c0e60
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 4E212A67E0AB0385FE549F52EC553B823A0EF58780F4C0035C91E866A3DE7EE495830A

Function 00007FF6E9976A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770A6

Part of subcall function 00007FF6E9962004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6E996200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99770DC

Strings

\\?\, xrefs: 00007FF6E9976A57, 00007FF6E9976A66
UNC, xrefs: 00007FF6E9976BBF
DXGIDebug.dll, xrefs: 00007FF6E9976A18

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 5ee070c7a9a2d28e62e9f515ed83f853671db38dc2e7408bbfbfb4c76bf99ee7
Instruction ID: ab2b8867a9c67793b327eb3a7fca72583586779c2403bef285b6afd5c711651e
Opcode Fuzzy Hash: 5ee070c7a9a2d28e62e9f515ed83f853671db38dc2e7408bbfbfb4c76bf99ee7
Instruction Fuzzy Hash: 3812BD23B18A4284EF10CF69D4442AD6371EF81B88F584135DB5D87AEADF3EE549C34A

Function 00007FF6E998A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E996129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6E9961396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998A747
EndDialog.USER32 ref: 00007FF6E998A7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF6E998A52B, 00007FF6E998A53A
GETPASSWORD1, xrefs: 00007FF6E998A773

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: e06248dbc4aeee0b93656e9211be1d96d36a322bc908ac185a645397fe30106c
Instruction ID: d65fd59a7303f71086fcfdf4d929eba8d5e172ddc8d9e0021d47d7be5d314006
Opcode Fuzzy Hash: e06248dbc4aeee0b93656e9211be1d96d36a322bc908ac185a645397fe30106c
Instruction Fuzzy Hash: 11B1D063F1974299FB108FA5D4443BC2372EF84794F484235DA1CAAADADE3EE446C309

Function 00007FF6E9986E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E9987E9B), ref: 00007FF6E9987080
CreateStreamOnHGlobal.COMBASE ref: 00007FF6E99870B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9987181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9987187

Strings

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6E9986ED5, 00007FF6E9986EE4
<html>, xrefs: 00007FF6E9986F13
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6E9986F2C, 00007FF6E9986F3B
</html>, xrefs: 00007FF6E9986F72, 00007FF6E9986F81

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 11aacd67445855d745a7f015c66ec02737dd5eaa18f827b11f87478fd2bdef61
Instruction ID: 188193528de6fe8184362a29e26570f32fa1aa31954fa0c2833df7666101ac59
Opcode Fuzzy Hash: 11aacd67445855d745a7f015c66ec02737dd5eaa18f827b11f87478fd2bdef61
Instruction Fuzzy Hash: F9819D63F18A4299FB14DFA5D8413ED2371AF44788F480135CE1D97A9BEE3AD506C34A

Function 00007FF6E999E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999E7CD

Strings

NAN(IND), xrefs: 00007FF6E999E6FB
inf, xrefs: 00007FF6E999E6D6
NAN, xrefs: 00007FF6E999E6B1
nan(snan), xrefs: 00007FF6E999E6F0
nan(ind), xrefs: 00007FF6E999E706
nan, xrefs: 00007FF6E999E6B8
NAN(SNAN), xrefs: 00007FF6E999E6E5
INF, xrefs: 00007FF6E999E6C3

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: bb54fc6cf0b7198537c6662f5d82708f3d52391aa75503c0f3715bceb0939bab
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: FC41CE33A0AB4589E704CF65E8417AD33A4EF18398F084136EE4C87B96EE3ED025C349

Function 00007FF6E998F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6E998F3CF
GetClassNameW.USER32 ref: 00007FF6E998F3FC
GetWindowLongPtrW.USER32 ref: 00007FF6E998F41D
SendMessageW.USER32 ref: 00007FF6E998F437
GetObjectW.GDI32 ref: 00007FF6E998F452
SendMessageW.USER32 ref: 00007FF6E998F487
DeleteObject.GDI32 ref: 00007FF6E998F490
GetWindow.USER32 ref: 00007FF6E998F49E

Strings

STATIC, xrefs: 00007FF6E998F402

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: e073d80798e7b5ea7c215367034a1c7ff3f2d9e19c4681dfd8a803a338859c47
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 1C31C323B0864246FA749F62E9147B963A1BF88BC0F081035DD4E87B57DE3EE8468785

Function 00007FF6E998AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6E998AEAE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 034361b68614648ac9f1887f084ea5e54d410436a350d6cde11b6359b354bc0c
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: 1C418463B1865282F7648F62E8547792361AF84B80F0C4439DD0E8BB97CF3EE945830E

Function 00007FF6E997B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E997BA12
GetProcAddress.KERNEL32 ref: 00007FF6E997BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF6E997BACA

Part of subcall function 00007FF6E997DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6E997DDDF

Strings

CryptProtectMemory, xrefs: 00007FF6E997BA08
Crypt32.dll, xrefs: 00007FF6E997B9F0
CryptUnprotectMemory, xrefs: 00007FF6E997BA1F
CryptUnprotectMemory failed, xrefs: 00007FF6E997BAC1
CryptProtectMemory failed, xrefs: 00007FF6E997BA80

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: 13cdb6039fbbbc11d95b7e828b01b6f28b3a5f6f5aed1d9d25ba19935ad4cd8d
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: B7313732E09B0280FA18AF16E95437527A0FF48B90F0C5135C85E877A7EE7EE581830E

Function 00007FF6E99887D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9988DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9988DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9988DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9988DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9988DE0

Strings

, xrefs: 00007FF6E99888BE
, xrefs: 00007FF6E9988A55

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: f70b963fbcba7fec90bf2027ad10dc1b417ed30690d90250c66aca16dc2c6d1f
Instruction ID: 0385b9e2eabb4a94c969b6a179c4c76af5c057d01ad0987a4ae1008c67701653
Opcode Fuzzy Hash: f70b963fbcba7fec90bf2027ad10dc1b417ed30690d90250c66aca16dc2c6d1f
Instruction Fuzzy Hash: E6F1D063F1464281EF289F66D4482FC2361AF44B98F485635CA2D937DADF7EE080C35A

Function 00007FF6E99957EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6E999598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E9995CAD
abort.LIBCMT ref: 00007FF6E9995CE1

Strings

csm, xrefs: 00007FF6E99958D1
csm, xrefs: 00007FF6E99959B1
csm, xrefs: 00007FF6E9995933

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: dd740dfe0674fd0dedd2fbc511d47a87c1024b2f4a2160dec5af0f94d0d77748
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 74E18C739086828EEB209F29D4803AE7BA0FF45758F184135DE8D87796DF3AE485C706

Function 00007FF6E9974F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9974E24: SysAllocString.OLEAUT32 ref: 00007FF6E9974E5F

VariantClear.OLEAUT32 ref: 00007FF6E9975125

Strings

ROOT\CIMV2, xrefs: 00007FF6E9974F7B
Windows 10, xrefs: 00007FF6E997510A
Name, xrefs: 00007FF6E99750F9
WQL, xrefs: 00007FF6E997502A
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6E9975017

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: e239674148916b3b86ed385d48bb686a5e75447bbdf48d09cd3fde563c0ee9a7
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: ED713C77A14A4585EB20DF26D8806AD77B4FF88B98B085132DE4E83BA5CF3ED544C345

Function 00007FF6E99972EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6E99974F3,?,?,?,00007FF6E999525E,?,?,?,00007FF6E9995219), ref: 00007FF6E9997371
GetLastError.KERNEL32(?,?,00000000,00007FF6E99974F3,?,?,?,00007FF6E999525E,?,?,?,00007FF6E9995219), ref: 00007FF6E999737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6E99974F3,?,?,?,00007FF6E999525E,?,?,?,00007FF6E9995219), ref: 00007FF6E99973A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6E99974F3,?,?,?,00007FF6E999525E,?,?,?,00007FF6E9995219), ref: 00007FF6E99973EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E99974F3,?,?,?,00007FF6E999525E,?,?,?,00007FF6E9995219), ref: 00007FF6E99973FB

Strings

api-ms-, xrefs: 00007FF6E9997391

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: a4579a134e52ca5b84d63afff28c3fb7894e9abc7e9edec541e7ad9aa4ef809d
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 3631E323A1E64285EE11AF06A8007B923D4FF48BA0F1D4535DD1D8B792DF3DE080C72A

Function 00007FF6E9991604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6E9991573,?,?,?,00007FF6E999192A), ref: 00007FF6E999162B
GetProcAddress.KERNEL32(?,?,?,00007FF6E9991573,?,?,?,00007FF6E999192A), ref: 00007FF6E9991648
GetProcAddress.KERNEL32(?,?,?,00007FF6E9991573,?,?,?,00007FF6E999192A), ref: 00007FF6E9991664

Strings

KERNEL32.DLL, xrefs: 00007FF6E9991624
ReleaseSRWLockExclusive, xrefs: 00007FF6E9991653
AcquireSRWLockExclusive, xrefs: 00007FF6E999163E

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: b6f2b542f1de7e3d3403ff03f2beae7bde317b7fe2f45274f2274a0bde5d216f
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 3E112D23E1AB4386FE758F02A9403B413A5BF08794F4D5435C81DCA397EEBEB485861A

Function 00007FF6E997ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E99751A4: GetVersionExW.KERNEL32 ref: 00007FF6E99751D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6E9965AB4), ref: 00007FF6E997EE05

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: e44bd263e3b6cc4801a93a890c47060370a8126141ca50e8f6b7abd001335655
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 175155B3B106518AEB04CFB9D4402AC37B1FB48B88B64403ADE1DA7B59EF39E556C704

Function 00007FF6E997F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6E997F074

Part of subcall function 00007FF6E99751A4: GetVersionExW.KERNEL32 ref: 00007FF6E99751D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6E997F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF6E997F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6E997F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF6E997F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF6E997F0CE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 6afb91cd7cb5568531796b94c78b700b3964e541f741f9f3a440216481fee579
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 4E311863F10A5189EB00CFB5D8802FC3770FF08758B58502AEE1DA7A59EE78D895C715

Function 00007FF6E9977918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9977C8C

Strings

exe, xrefs: 00007FF6E99779AF, 00007FF6E99779BE
.rar, xrefs: 00007FF6E9977969, 00007FF6E9977978
sfx, xrefs: 00007FF6E99779F3, 00007FF6E9977A02
rar, xrefs: 00007FF6E9977A9B, 00007FF6E9977AAA, 00007FF6E9977B67, 00007FF6E9977B7C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 9b8f9fc42827f07993982fd9f343e807743a6e075335c2f478db097a4822f4c0
Instruction ID: c51d5cb8268856e840cbfba1fb989d4cd912bf80e86ba94eb12021bbaf769264
Opcode Fuzzy Hash: 9b8f9fc42827f07993982fd9f343e807743a6e075335c2f478db097a4822f4c0
Instruction Fuzzy Hash: BDA19D23A14A0680EA049F25D8853BC2361EF54BA8F5C1231DD1D877EBDF7EE585C38A

Function 00007FF6E9995CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6E9995D58

Part of subcall function 00007FF6E9995210: abort.LIBCMT ref: 00007FF6E9995223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6E9995DA3
abort.LIBCMT ref: 00007FF6E9995FD1

Strings

RCC, xrefs: 00007FF6E9995D74
MOC, xrefs: 00007FF6E9995D6C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 1e788cc89f5a7b421e513002fa6c44bc12a4e5ffe8ccb72ca4027aacebee0eea
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 1991AF73A08B918EE711CF65E4803AD7BA0FB04788F184129EE4D97B56DF39D195C706

Function 00007FF6E9994F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E9994FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6E9995040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6E9992F5E), ref: 00007FF6E999508F

Strings

csm, xrefs: 00007FF6E9995026
f, xrefs: 00007FF6E9994FBE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 4056e29f6ddcd9dc62ab369d7bba688c6972ed11f2e2ec7681a3599e8d7eb632
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 61519033A196028ADB24CF15E444B2E2795FF45B98F588030DE1E8774ADF7AE881C74A

Function 00007FF6E996CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E996D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D0D7

Part of subcall function 00007FF6E996DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6E996CF4B), ref: 00007FF6E996DE27
Part of subcall function 00007FF6E996DE04: GetLastError.KERNEL32 ref: 00007FF6E996DE88
Part of subcall function 00007FF6E996DE04: CloseHandle.KERNEL32 ref: 00007FF6E996DE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF6E996CF3F
SeRestorePrivilege, xrefs: 00007FF6E996CF5E

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 56eb12e04902f8cdd3d9974dd122819d94118814fcd2e4f07e3976d6fdbba36c
Instruction ID: 0765795c0409916d3436c5dda3ec1683ca692ef88c110a55e30b0a066c4b33dd
Opcode Fuzzy Hash: 56eb12e04902f8cdd3d9974dd122819d94118814fcd2e4f07e3976d6fdbba36c
Instruction Fuzzy Hash: 1A51BE63F2874285FB10DFA5D8413BD23B0AF957A4F080135DE2D97697DE3EA485C28A

Function 00007FF6E9987B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6E9987B6F
GetWindowRect.USER32 ref: 00007FF6E9987BC0
ShowWindow.USER32 ref: 00007FF6E9987C96
ShowWindow.USER32 ref: 00007FF6E9987CC3

Strings

RarHtmlClassName, xrefs: 00007FF6E9987C4B

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction ID: b6db6a76e4c46bd41c1cbbf9369343a5ba8618f923b340f2dbec1809ee031090
Opcode Fuzzy Hash: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction Fuzzy Hash: 1E51A423A09B418AEB34DF21E45537AA7A1FF85780F084435DE4E87B56DF3EE4458705

Function 00007FF6E998FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E998FD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E998FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E998FE1B

Strings

sfxcmd, xrefs: 00007FF6E998FD3C
sfxpar, xrefs: 00007FF6E998FDB5

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 3f2466e4a4d0866a754e80d9881e3536653d903d5d2b18ad3a3031b9ab7b11ad
Instruction ID: d83c838ad391440a19a77afa7cc140e433006370c2792dd00f56799bea23e238
Opcode Fuzzy Hash: 3f2466e4a4d0866a754e80d9881e3536653d903d5d2b18ad3a3031b9ab7b11ad
Instruction Fuzzy Hash: EB315D73E14A0585EB148F65E4852AC2371EF48B98F181135DF5D97AAADF39D081C289

Function 00007FF6E998FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00007FF6E998FF34, 00007FF6E998FF99
RENAMEDLG, xrefs: 00007FF6E998FF60

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: a8a60c15c9fac1f941cdd6a836d32a25e057d90718b68ee73cc2af035d17a8f4
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: CB21F422A09A4791FB248F15EC4437423A1EF4AB88F5C103AD94DCB362DE3EE4D5834A

Function 00007FF6E999BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6E999BFD0
GetProcAddress.KERNEL32 ref: 00007FF6E999BFE6
FreeLibrary.KERNEL32 ref: 00007FF6E999C00B

Strings

CorExitProcess, xrefs: 00007FF6E999BFDF
mscoree.dll, xrefs: 00007FF6E999BFC7

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: aa5bccdfd406e88a4d650dbb0f347e8a477ca695a23fe2d744ce998f12de194f
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: FBF04F33E19A4285EF888F11E8443B963A0EF88794F4C5035D95F86666EE7EE484C705

Function 00007FF6E99A45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E99A4605

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: f712ba17cf563549dc0552280a40414067b5c0eb0bc575402366bf4d8ed3d69e
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 6481ED33E1865289F7109F2598807BD27A5FF45B98F094135DD0E97B96CFBEA841C30A

Function 00007FF6E9973AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6E9973BBB
CreateFileW.KERNEL32 ref: 00007FF6E9973C24
SetFileTime.KERNEL32 ref: 00007FF6E9973CEC
CloseHandle.KERNEL32 ref: 00007FF6E9973CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9973D2C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: f75a2e2a3a1635b10ac7663bc56c733a9042ffa6b3fef8e66de610f6d5e077c2
Instruction ID: cf85b416f46099240f800e880f6e2d6e6a7308d612e04bf5b2f264a4f07aae67
Opcode Fuzzy Hash: f75a2e2a3a1635b10ac7663bc56c733a9042ffa6b3fef8e66de610f6d5e077c2
Instruction Fuzzy Hash: 9451D163F04A0299FB509F75E8413BD2371EF447A8F084635EE1D866D6DE3E94258309

Function 00007FF6E99A3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6E99A4767), ref: 00007FF6E99A3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF6E99A406D
WriteFile.KERNEL32 ref: 00007FF6E99A4093
WriteFile.KERNEL32 ref: 00007FF6E99A40D2
GetLastError.KERNEL32 ref: 00007FF6E99A410A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: c712a9378cf2ef7249a0e02c32b633a085f021faacc8d43e2cd9d58402da1228
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: CC51BE33E18A5189E710CF65D8403AC3BB1FB54798F088135DE4A97B9ADF7AD185C709

Function 00007FF6E9991E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6E9974DF4), ref: 00007FF6E9991E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6E9974DF4), ref: 00007FF6E9991F09
SysAllocString.OLEAUT32 ref: 00007FF6E9991F16

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 7e9601d2247a13adf5892490d0984888a090eff7ba9d3fa4ff308a8b8e371313
Instruction ID: b64b02f9bab5ec618f77bdb5a6efb394f04fb422478643e300e5f5905e1020b3
Opcode Fuzzy Hash: 7e9601d2247a13adf5892490d0984888a090eff7ba9d3fa4ff308a8b8e371313
Instruction Fuzzy Hash: 4541A533A096458EEB249F6294403B92291FF04BE4F1C4634EA6DC77D6DF3EE1418305

Function 00007FF6E999F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E999F536

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 075f9ab845ddaad2449ce930087d9c8d47422969e9f614b1fb2d2a584a298599
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 64411963B09A4285FA158F13A8047B5A395BF18BD0F0D4535DD1DCF79AEE3EE880834A

Function 00007FF6E99A56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6E99A56FF
_set_statfp.LIBCMT ref: 00007FF6E99A571A
_set_statfp.LIBCMT ref: 00007FF6E99A5736
_set_statfp.LIBCMT ref: 00007FF6E99A5772

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 558d24241288c0273b9e8b835ac4e1e141063a61c0e3a1117124ce1f3cc3ee38
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 8411BF77F1CA0791F6540924E54237D1185EF543A0E5C4230EA7EDA6D7CEEEAC40424F

Function 00007FF6E998FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6E998FE41
GetMessageW.USER32 ref: 00007FF6E998FE58
TranslateMessage.USER32 ref: 00007FF6E998FE63
DispatchMessageW.USER32 ref: 00007FF6E998FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF6E998FE7C

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: ae0ac25130fbff172d1ebcbcfb0f10dd977027c584758655a005a1f55435e413
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 57F04F23F2844682F7208F70E898B762211FFA4B05F481030E54F85896DE2DD599C705

Function 00007FF6E999625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E9996286
abort.LIBCMT ref: 00007FF6E99964EA

Strings

csm, xrefs: 00007FF6E99962AB
csm, xrefs: 00007FF6E999641A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: a0df875aad1dc39cf140a58ecfa7a4754453b0de636fe86b5f42a8c8daecba3d
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: F771A1736086918ADB618F65D05077D7BA0EF05B89F188136DE8C87B8ACF3ED491C74A

Function 00007FF6E99980F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E99982ED

Strings

, xrefs: 00007FF6E9998276
*, xrefs: 00007FF6E9998221

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 5d63b0434f5c6a4d7830f0032f1c2e7fd318a5804cd7aa9d0b2482284c1055b8
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 0D51247391C6428EE7658E2A84453BC37B1EF15B59F1C113DD64AC61DACF2EE481C60E

Function 00007FF6E99A1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6E99A17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF6E99A1894
GetStringTypeW.KERNEL32 ref: 00007FF6E99A18AE

Strings

$%s, xrefs: 00007FF6E99A175A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 589fb05702d63cbf7a577048cd07ed2e2071b33b1bbbcf4e43dc69cfa334260a
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 96415D23E15B818AFB618F2AD8003A92291FF44BA8F480635DE1D877D6DF7DE4418309

Function 00007FF6E99966A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9995210: abort.LIBCMT ref: 00007FF6E9995223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E999674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6E9996776

Strings

csm, xrefs: 00007FF6E9996876

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: af11a71e0f9990b08b3b3591b3ce678be30be907a00325bd357b0a73a75c61f7
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 4C514F736197418BEA20AF16E04036E77A4FB89B94F580534EF8D87B56CF39E491CB06

Function 00007FF6E99A4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6E99A4446
WriteFile.KERNEL32 ref: 00007FF6E99A4479
GetLastError.KERNEL32 ref: 00007FF6E99A449B

Strings

U, xrefs: 00007FF6E99A4424

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: c8344631f5714f6475ede7e453da36f06a6555024430cfeb87e9f587ffb9ef98
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 2641B033A19A8182EB208F25E8443BA77A0FB88794F484131EE4DC7799DFBDD441C745

Function 00007FF6E99890B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E99890D9
GetObjectW.GDI32 ref: 00007FF6E9989107
ReleaseDC.USER32 ref: 00007FF6E99891BB

Strings

, xrefs: 00007FF6E9989153

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 6427594f6908fbf46c42462a393ce3fdac9b1a121148f111599874ca3c94b8d1
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 5231273670874286EA04DF62BC1872AB7A0FB89FD1F444435ED4B87B55CE3DE8498B45

Function 00007FF6E997E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6E998317F,?,?,00001000,00007FF6E996E51D), ref: 00007FF6E997E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6E998317F,?,?,00001000,00007FF6E996E51D), ref: 00007FF6E997E8CB
CreateEventW.KERNEL32(?,?,?,00007FF6E998317F,?,?,00001000,00007FF6E996E51D), ref: 00007FF6E997E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF6E997E900

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: d688b4d1a9a0e282dca2e47d5f939b653d57a2372785f68c8f790c4d8f5cc903
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 0F21A133E1960186F7508F25E4443B936A2EF94B09F1C8034CA098A296DF7F9895C78A

Function 00007FF6E99885E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E99885EC
GetDeviceCaps.GDI32 ref: 00007FF6E99885FD
ReleaseDC.USER32 ref: 00007FF6E998860A

Strings

, xrefs: 00007FF6E9988610

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: fbc66f276a180d40c267f8b5387b5ae86c389ea55a052a2035b3051e7638ba8b
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: C2E0C222B0864182FF085BF6B98923A6261EF4CBD0F198035EA1F8B795CE3DCCC44304

Function 00007FF6E996D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6E996D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996D560

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 580eb8bd8f76e11621dd22c3f902231a9c49c84aaab9ae48d1a37248dc949a6d
Instruction ID: 121b66ba22d960279e85ff3c42bc57283041b33882510bcbb6688471a48c2618
Opcode Fuzzy Hash: 580eb8bd8f76e11621dd22c3f902231a9c49c84aaab9ae48d1a37248dc949a6d
Instruction Fuzzy Hash: CDA1C263A28B8281EA10DF65E8453BD6361FF85784F485131EA5C83AEBDF3EE544C349

Function 00007FF6E9980548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E99805FC
SetLastError.KERNEL32 ref: 00007FF6E9980697

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ec58c6949f9e474dd952ff72457f5410cce056d9892a96e8c34aae8edf97276e
Instruction ID: c6b7d2f3456012fb065ef5dc5f91f568aa171434b5420c39ccdf386400634ce4
Opcode Fuzzy Hash: ec58c6949f9e474dd952ff72457f5410cce056d9892a96e8c34aae8edf97276e
Instruction Fuzzy Hash: AD519CA3E14A4299FB149F65D4453EC2321EF84B98F484236DA1C97BDBEE2EE140C349

Function 00007FF6E9989D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6E9989DBC
GetLastError.KERNEL32 ref: 00007FF6E9989E08
CreateDirectoryW.KERNEL32 ref: 00007FF6E9989F10
LocalFree.KERNEL32 ref: 00007FF6E9989F20

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: decc2da6846149065e747433b686ffe20880dedc2611ac47de6390cb5f5191d4
Instruction ID: 98a4381f29703f461d0298afb2dbf0b8fb091b3330087c0d704dd4bd9ce8622e
Opcode Fuzzy Hash: decc2da6846149065e747433b686ffe20880dedc2611ac47de6390cb5f5191d4
Instruction Fuzzy Hash: 0E515033A18B4286E754CF61E8443AE7764FF84B84F541039EA4E97A59DF3ED804CB45

Function 00007FF6E999DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999DBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF6E999DC81
GetLastError.KERNEL32 ref: 00007FF6E999DCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999DCD6

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 33f9cc3e41c5bee617dfb8b0dcc1176285fd8236222f7ff45ee3f6380d1b655f
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: B6417433A0C7424AFB669F55D18037962A0EF90B90F1C4131EA5D87AD7EF6FD841870A

Function 00007FF6E9973980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6E99739BD
MoveFileW.KERNEL32 ref: 00007FF6E9973A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9973AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E9973AF1

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: c1c548311496109c7c973564b1f0111f496352b18342627c01e39ee1156b1353
Instruction ID: 144ff371dcf90aadc6b63e6d6585b33e5cab9c7d440b70450509879d42f63f27
Opcode Fuzzy Hash: c1c548311496109c7c973564b1f0111f496352b18342627c01e39ee1156b1353
Instruction Fuzzy Hash: 2541B263F14B5184FB00CF79E8462AC3371BF44BA4B085231DE5D96ADADF7AD051C209

Function 00007FF6E99A0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6E999C45B), ref: 00007FF6E99A0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6E999C45B), ref: 00007FF6E99A0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6E999C45B), ref: 00007FF6E99A0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6E999C45B), ref: 00007FF6E99A0C57

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: e2ddb7c9ada53b24c2b27d6b16337809ea96031a00a01bc3c3794a053cca8e31
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: A121DB72F19B5181EA249F126440229B7A4FF59FD0B0C4134DE9EA3BD6DF7EE4528309

Function 00007FF6E999D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E9997F28,?,?,?,00007FF6E9999D35), ref: 00007FF6E999D44A
SetLastError.KERNEL32(?,?,?,00007FF6E9997F28,?,?,?,00007FF6E9999D35), ref: 00007FF6E999D4B2
SetLastError.KERNEL32(?,?,?,00007FF6E9997F28,?,?,?,00007FF6E9999D35), ref: 00007FF6E999D4C8
abort.LIBCMT ref: 00007FF6E999D4CE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 07c7231f9c2ae052e37fbbcba33dbe5bc1b8c28e38e618ae0e273abb119c7235
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 43016D23E097064AFB5A6F25A6953B812619F587D0F1C0438E91E877E7ED2EF840420A

Function 00007FF6E9988590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E9988598
GetDeviceCaps.GDI32 ref: 00007FF6E99885AE
GetDeviceCaps.GDI32 ref: 00007FF6E99885C2
ReleaseDC.USER32 ref: 00007FF6E99885D3

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 4fa570234dfcb198d4de3c875b0ca7d5cd1127de0b769cc28df6bbbb026f96e4
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: E9E01262F0970282FF185FB26C5933621A0AF48742F0C4439D81FCB352DE3EA885C719

Function 00007FF6E996E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E996E549

Strings

DXGIDebug.dll, xrefs: 00007FF6E996E35A

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: a08899e38426230943dcdae29aa39143af9d13bf0e4c208fbdbfd644d4e58482
Instruction ID: b8415b59f9f991d940d28170d6dcc0c9d57289022e595d7cb46dafd9c79c9c98
Opcode Fuzzy Hash: a08899e38426230943dcdae29aa39143af9d13bf0e4c208fbdbfd644d4e58482
Instruction Fuzzy Hash: 10719C73A14B8186EB14CF65E4443ADB3A4FF54794F084226DBAC47B9ADF79E061C348

Function 00007FF6E999E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999E237

Strings

e+000, xrefs: 00007FF6E999E2DF
gfff, xrefs: 00007FF6E999E362

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 2b593ed66d1311b25f6a9259fcc9d9b31a3b5d9414290257fc4b541fde230889
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 4851F363B187C18AE7258F79994136D6A91EF81B90F0CD231DA9CC7BD6CE2ED444C706

Function 00007FF6E9979408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E99795A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E99795E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E997959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6E99795A2

Strings

SIZE, xrefs: 00007FF6E9979443

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 3190869bd73ecd60fb0f53392e682d412e6871c3627f6ccf45194b60311ac42a
Instruction ID: 86fa4832baac2d2c2abad1368486d2b7507ec560f427b208ce2b8da3a05f5faf
Opcode Fuzzy Hash: 3190869bd73ecd60fb0f53392e682d412e6871c3627f6ccf45194b60311ac42a
Instruction Fuzzy Hash: 4C41E363A2878285EE10DF28E4413BD6360EF857A4F584231EA9D866D7EE3ED580C709

Function 00007FF6E999C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E999C2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6E9992CD5), ref: 00007FF6E999C30B

Strings

C:\Users\user\Desktop\442.docx.exe, xrefs: 00007FF6E999C2F9

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\442.docx.exe
API String ID: 3307058713-4147804102
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 3882e8d9e53405b351baa89742f6bb95991995160109f7d1aba737eafb094f1a
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: D8419033A08B528AEB15DF25A8412BC77A4FF447D4B484031F94D87B86EE3EE441C35A

Function 00007FF6E9989B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E996255C: GetDlgItem.USER32 ref: 00007FF6E99625AC
Part of subcall function 00007FF6E996255C: SetWindowTextW.USER32 ref: 00007FF6E99625C8

EndDialog.USER32 ref: 00007FF6E9989C24
SetDlgItemTextW.USER32 ref: 00007FF6E9989CAA

Strings

ASKNEXTVOL, xrefs: 00007FF6E9989B72

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction ID: 49371f8b3dbd1c57f66d0914b4e8efc4ca52966a3d80e69f599b73223daffad7
Opcode Fuzzy Hash: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction Fuzzy Hash: 4A418723A1864181FA249F16D9543B923A1EF85BC4F1C4039DE4E9B797DE3FE441C34A

Function 00007FF6E9979638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6E99796EA

Part of subcall function 00007FF6E9980F68: WideCharToMultiByte.KERNEL32 ref: 00007FF6E9980F99

Strings

$%s, xrefs: 00007FF6E99796D7
@%s, xrefs: 00007FF6E99796CE

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 397a71c17c91124df3f781bcd008871c8e83550b8c8ba67e3b11ffa7b8449f8e
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 7D31E073B19A4699EE108F26E4403E923A0FF547C4F480032EE0D4B796EE3EE505C705

Function 00007FF6E999EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6E999EB76
GetFileType.KERNEL32 ref: 00007FF6E999EB8C

Strings

@, xrefs: 00007FF6E999EBB7

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 3d6ae26ff6d14ff8f5b40cc6eb3b9c957350e4ca1edfb29289ce529305511ec8
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 87219323E08A8245EB608F7694903792655EF45774F2C4335D66F877D5CE3ED881C30A

Function 00007FF6E9994078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6E9991D3E), ref: 00007FF6E99940BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6E9991D3E), ref: 00007FF6E9994102

Strings

csm, xrefs: 00007FF6E99940EF

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 4c950e6dafea189197207d7c6934a71f00312a08161958e67f8ec59c655b3359
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 0B112B32A18B8182EB218F15E84026AB7E1FB88B94F1C4231DE8D47765DF3DD565C705

Function 00007FF6E997EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E997E95F,?,?,?,00007FF6E997463A,?,?,?), ref: 00007FF6E997EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E997E95F,?,?,?,00007FF6E997463A,?,?,?), ref: 00007FF6E997EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6E997EA78

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 5dc29a1d74811edf6d073cb739052e8ba2776443635d60df6f109f47a5b24dee
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 27E01267E1980241FA005F259C417B82610BF607B0F980331D03EC15F3AE6E9545C30B

Function 00007FF6E997A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E997A447
FindResourceW.KERNEL32 ref: 00007FF6E997A45D

Strings

RTL, xrefs: 00007FF6E997A453

Memory Dump Source

Source File: 00000000.00000002.1740331579.00007FF6E9961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9960000, based on PE: true

Associated: 00000000.00000002.1740236906.00007FF6E9960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740534134.00007FF6E99A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740678516.00007FF6E99C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1740953018.00007FF6E99CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9960000_442.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: f15de1f9ae71c41d1989d07f86dc03ae2b068faf646e052812489db6881d507a
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: CDD05B62F0960181FF194F7254453741250DF1CB45F4C4038C81D46392EE6ED0D4C75A

Analysis Process: rfusclient.exePID: 7596, Parent PID: 5856COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1056
Total number of Limit Nodes:	13

Executed Functions

Function 60046B90 Relevance: 19.6, APIs: 13, Instructions: 128
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 60046BAD
CreateEventA.KERNEL32 ref: 60046BD5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 60046C17
GetCurrentThread.KERNEL32 ref: 60046C1B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 60046C23
DuplicateHandle.KERNELBASE ref: 60046C4F
GetThreadPriority.KERNEL32 ref: 60046C66
TlsSetValue.KERNEL32 ref: 60046C92
TlsGetValue.KERNEL32 ref: 60046CD0
abort.MSVCRT(?,?,?,431BDE83,60049B07), ref: 600F242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,60049B07), ref: 600F246C
GetProcAddress.KERNEL32 ref: 600F248C
GetProcAddress.KERNEL32 ref: 600F24A0

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: Current$Thread$AddressHandleProcProcessValue$CreateDuplicateEventModulePriorityabort
String ID:
API String ID: 1214264455-0
Opcode ID: 410b62446c5b15087784118d393726af8ad3af1c6510768b0cfe24c9080fbcd1
Instruction ID: ac7813ece771cc05782aa88c49ed25db049e9b5945a9c84d3d27f128b08f52a0
Opcode Fuzzy Hash: 410b62446c5b15087784118d393726af8ad3af1c6510768b0cfe24c9080fbcd1
Instruction Fuzzy Hash: 184107B18053008FDB00AF79D98931ABFE4FF55318F014A6DE89497255E7B9D944CBA2

Function 60038BA0 Relevance: 24.1, APIs: 16, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 600F2382
abort.MSVCRT ref: 600F2387
abort.MSVCRT ref: 600F238C
abort.MSVCRT ref: 600F2394
abort.MSVCRT ref: 600F2399
abort.MSVCRT ref: 600F239E
abort.MSVCRT ref: 600F23A3
abort.MSVCRT ref: 600F23A8
abort.MSVCRT ref: 600F23AD
abort.MSVCRT ref: 600F23B2
abort.MSVCRT ref: 600F23B7
abort.MSVCRT ref: 600F23BC
abort.MSVCRT ref: 600F23C1
abort.MSVCRT ref: 600F23C8
abort.MSVCRT ref: 600F23CD

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 232a316ae62adc1f061dae762604906f509dae3dcd2c179dc4aee91837e6b265
Instruction ID: 2a3715adb601e08488ac31df6062b6679b4abacdc736da6ccf8ebbb91ca3cb3f
Opcode Fuzzy Hash: 232a316ae62adc1f061dae762604906f509dae3dcd2c179dc4aee91837e6b265
Instruction Fuzzy Hash: B901C4B151428A8BD700DF39C4C5729BFF4BF62304F850855E8404B342D738A89AD765

Function 60044970 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 60044989
_unlock.MSVCRT ref: 600449B1
calloc.MSVCRT ref: 600449FF

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction ID: 0c166785852f1f150ed50a268d62f77157ee5b2d2c4812f11a4bbb90c09cde79
Opcode Fuzzy Hash: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction Fuzzy Hash: E5113AB1504211EFEB40DF28D58071ABBE4BF99200F5586B9D898CB245EB74D844CB66

Function 5FDB12F0 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 5FDB134C

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4e4ba96908052b193defb16cc5b5637d2fe5207c36d458c477c76d7daa6c427a
Instruction ID: 11a52fbeab7588a8d8db17359b811af273bc03cd0c6fe6f7a29fdaa7497f9d4e
Opcode Fuzzy Hash: 4e4ba96908052b193defb16cc5b5637d2fe5207c36d458c477c76d7daa6c427a
Instruction Fuzzy Hash: A71161B12093019BD780BF69E98176FBBE4AF84654F444D2EE8C58B716E774E4408FD2

Non-executed Functions

Function 60046AD0 Relevance: 10.6, APIs: 7, Instructions: 93
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 600464C0: calloc.MSVCRT ref: 6004654E

TlsAlloc.KERNEL32(?,?,00000000,6004801E,?,?,?,431BDE83,60049B07), ref: 60046B04
fprintf.MSVCRT ref: 60046B69
abort.MSVCRT(?,?,?,431BDE83,60049B07), ref: 600F2425
abort.MSVCRT(?,?,?,431BDE83,60049B07), ref: 600F242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,60049B07), ref: 600F246C
GetProcAddress.KERNEL32 ref: 600F248C
GetProcAddress.KERNEL32 ref: 600F24A0

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: AddressProcabort$AllocHandleModulecallocfprintf
String ID:
API String ID: 2703921052-0
Opcode ID: 54c4e5a1ee59cf1e43e08aee5c5431469dde0b0b896b8dbecb9d12124f035eda
Instruction ID: d8aa848e68908a6d7696209b4b49d7c978773fb05b5a79990f158b1dcb7c2e14
Opcode Fuzzy Hash: 54c4e5a1ee59cf1e43e08aee5c5431469dde0b0b896b8dbecb9d12124f035eda
Instruction Fuzzy Hash: D6316FB1905600DFDB00AF69D8C971ABFE4FF65318F01462EE58497361E7B89841CB96

Function 5FC845A0 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 600EDBF0: malloc.MSVCRT ref: 600EDC07

memcpy.MSVCRT ref: 5FC845FE
memcpy.MSVCRT ref: 5FC8464B

Strings

`, xrefs: 600EEDA4

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: memcpy$malloc
String ID: `
API String ID: 962570267-4168407445
Opcode ID: 54617e6cf0e739a769a6fe4b04d7bf324360dc7ced61455a20b47c441c689987
Instruction ID: 41206e7ee7ee6923ed55b2c7d090c81aa7435c59bd6cc30801b3252a49de3530
Opcode Fuzzy Hash: 54617e6cf0e739a769a6fe4b04d7bf324360dc7ced61455a20b47c441c689987
Instruction Fuzzy Hash: 72613BB190D3858ED300DF25D88031BBFE1BFD6348F114A6EE4C8A7251E7B59245DB92

Function 5FC83D30 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC83DDA

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 7631be70d690cbad5aceab812d89728d19d2f949dd17beb1756a3c662439505a
Instruction ID: c63c247e013262510305809d3f8d8da51ce8984b166127b1987ef2d25b17e6eb
Opcode Fuzzy Hash: 7631be70d690cbad5aceab812d89728d19d2f949dd17beb1756a3c662439505a
Instruction Fuzzy Hash: 1751B0B4D54358DFCB04DFA5C480A9EBBF4BF89308F10852EE844AB345E774A849CB91

Function 5FC842D0 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC8437A

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 224dd945d00b3fc0ab9bbe8d16e05aa4b9607eeb852bfa9137488e22c9e8e443
Instruction ID: 30fcbe6c4b0b261427b8eb5804fd8cc4d88139f3b0896db89645fe435fffec3e
Opcode Fuzzy Hash: 224dd945d00b3fc0ab9bbe8d16e05aa4b9607eeb852bfa9137488e22c9e8e443
Instruction Fuzzy Hash: 8351D2B4D04358DFCB00DFA5C480A8EBBF4BF89308F11856EE844AB359E774A849CB91

Function 5FC84000 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FC840AA

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 809941c1d581cb8dc39b6b3b1445724cdaa2f47133f87fedc4ccd28e194aaaf0
Instruction ID: 3065ccc242f0fc54a986ef9d4dd1ec3644a37410d3b947c712038cc5dadb736c
Opcode Fuzzy Hash: 809941c1d581cb8dc39b6b3b1445724cdaa2f47133f87fedc4ccd28e194aaaf0
Instruction Fuzzy Hash: 9851CEB4D043589FCB00DFA5C480ACEBBF4BF99308F11856EE854AB345E775A849CB91

Function 5FC83AE0 Relevance: 1.3, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1521ad2825085fff8fc75a6096d1b8867f4785f2e833fefdcb5acc12bc86f621
Instruction ID: fff8a6c72a5bee13703625dc82e4a90614b88842dff3e8e56678c0b7a29e6b94
Opcode Fuzzy Hash: 1521ad2825085fff8fc75a6096d1b8867f4785f2e833fefdcb5acc12bc86f621
Instruction Fuzzy Hash: 2531D0B05083809BC3109F29C48034BFBE5BFC9758F509A2DF9999B320D774A9498B82

Function 5FC83760 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48e6a791e94df901c83183fdace2040c9bea86b6a43ca92c1d1e16c2487ac69
Instruction ID: 969e36c6c9c431466931c3768b07244cd047a394ccded2b29a86a2539ba3cc3c
Opcode Fuzzy Hash: e48e6a791e94df901c83183fdace2040c9bea86b6a43ca92c1d1e16c2487ac69
Instruction Fuzzy Hash: 4D31E3B06087428FC705AF29C58531FBBE1BFD5208F014D2DF5849B306EB74D8498B82

Function 5FC838C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be8ab299d6cf77461f946d58c247347db370bcd5a4b8f92a4e81b08371a1cb7
Instruction ID: 83838eb31ebb297d6a4a1b70d45768278c55e7f49b6849013a153157ec81746d
Opcode Fuzzy Hash: 0be8ab299d6cf77461f946d58c247347db370bcd5a4b8f92a4e81b08371a1cb7
Instruction Fuzzy Hash: C831E2B06087428FC705AF29C88531FBBE1BFE5248F114D2DF5849B306EBB4D8498B92

Function 6004BEB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction ID: b6e4a677f8666ddca81222038f170fbd865ffbdb4ebf838b8f4e79727d32bfeb
Opcode Fuzzy Hash: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction Fuzzy Hash: 48C08CB0C093408FC200BF38850A33CFAB0AFA3208F852CACE48023202F735C01C865B

Function 60049640 Relevance: 19.8, APIs: 13, Instructions: 272
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 60049678
GetThreadTimes.KERNEL32 ref: 600496A1
GetSystemTimeAsFileTime.KERNEL32 ref: 60049717
QueryPerformanceFrequency.KERNEL32 ref: 60049757
QueryPerformanceCounter.KERNEL32 ref: 6004976F
GetCurrentProcess.KERNEL32 ref: 60049818
GetProcessTimes.KERNEL32 ref: 60049841
_errno.MSVCRT ref: 60049852

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: d05ccea37e518d453f9e171f5e251a55345a5622f0273139ba3c70f026d55729
Instruction ID: eed120ed942123367842f8d928712e37a86d3fd297b3f0ece1a036d634c03573
Opcode Fuzzy Hash: d05ccea37e518d453f9e171f5e251a55345a5622f0273139ba3c70f026d55729
Instruction Fuzzy Hash: 61B1F1B55083019FC700DF68CA8964ABFF5FF89358F458A2EE89997314E774E944CB82

Function 600454A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 600454DD
CreateSemaphoreA.KERNEL32 ref: 6004551F
CreateSemaphoreA.KERNEL32 ref: 60045546
InitializeCriticalSection.KERNEL32 ref: 60045565
InitializeCriticalSection.KERNEL32 ref: 60045570
InitializeCriticalSection.KERNEL32 ref: 6004557B

Strings

l, xrefs: 600454CE

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: 4755ec9418ec6fb7fb2a43cefea765496c3b2ab05e821a3456f315ae67c2cdfe
Instruction ID: 53fec4f298815be43a076d7b49a6ce6b7fb52db9eadafbb7c619a5d71367f588
Opcode Fuzzy Hash: 4755ec9418ec6fb7fb2a43cefea765496c3b2ab05e821a3456f315ae67c2cdfe
Instruction Fuzzy Hash: EE418DB6904300CFEB10AF68D98836ABFE4EF81315F118A6DD9948B285E776D454CF82

Function 6004BB90 Relevance: 15.2, APIs: 10, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff69c2fc6999567a92813603e8b786ba5dc42b691ea617655356268685371cc9
Instruction ID: 4837673df1ff236e0ae415d3d7c617e3b017116355599ccb5b5aa2d5f1d95529
Opcode Fuzzy Hash: ff69c2fc6999567a92813603e8b786ba5dc42b691ea617655356268685371cc9
Instruction Fuzzy Hash: 50718D70548609CFC701EF79D4C676EBBE5AFB2308F41482DE484AB216DB74A845CBA7

Function 60045620 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 201
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 60047AC0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000030,76ECE820), ref: 60047AD0

Part of subcall function 5FF9FE90: WaitForMultipleObjects.KERNEL32 ref: 5FF9FF03

ResetEvent.KERNEL32 ref: 6004569F

Part of subcall function 60047E30: TlsGetValue.KERNEL32(?,?,00000000,?,60048065,?,?,?,?,431BDE83,60049B07), ref: 60047E42

WaitForSingleObject.KERNEL32 ref: 600456DF

Strings

(, xrefs: 6004576D

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: ValueWait$EventMultipleObjectObjectsResetSingle
String ID: (
API String ID: 2327612466-3887548279
Opcode ID: 87e19c41f7eab32f4a1b5544d67e431a0369addc79dfdaa7620c28db773181f8
Instruction ID: 52e6febd355ebc2545313069d0f8c490cfacf9d6d291744c4a4d81fe1f86e72a
Opcode Fuzzy Hash: 87e19c41f7eab32f4a1b5544d67e431a0369addc79dfdaa7620c28db773181f8
Instruction Fuzzy Hash: 9261FF7990C311CBD710AF69A58931EBEE0AFA1746F41483DE98497242EB35CC44CBAB

Function 5FD37610 Relevance: 12.4, APIs: 3, Strings: 5, Instructions: 406
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 5FD3778A

Strings

+, xrefs: 5FD37BE8
0123456789abcdef, xrefs: 5FD376F7
, xrefs: 5FD37C15
0123456789ABCDEF, xrefs: 5FD376EA
, xrefs: 5FD376EF

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: strlen
String ID: $ $+$0123456789ABCDEF$0123456789abcdef
API String ID: 39653677-2690344263
Opcode ID: ee000ed938d97882d42209c615fa3d307eb042f08237b63fdef4c7dae224f58c
Instruction ID: 9018277a907f595966b0f9cece8612c1f6c9ea2228c2a7c8f742aa52d7b0cb3a
Opcode Fuzzy Hash: ee000ed938d97882d42209c615fa3d307eb042f08237b63fdef4c7dae224f58c
Instruction Fuzzy Hash: 100237B4A0C7858FC794CF29C48075ABBE1BF89344F148D2DEA989B392D775E940CB52

Function 5FD2FC10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToFiber.KERNEL32(?,?,?,?,5FC81CE1,5FC970E0,?,5FC9742C,?,?,?,?,?,?,?,?), ref: 5FD2FCB9
memcpy.MSVCRT(?,?,?,?,?,5FC81CE1,5FC970E0,?,5FC9742C,?,?,?,?,?,?,?), ref: 5FD2FD50
SwitchToFiber.KERNEL32(?,?,?,?,?,5FC81CE1,5FC970E0,?,5FC9742C,?,?,?,?,?,?,?), ref: 5FD2FD7C

Strings

`, xrefs: 5FD2FFFE

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: FiberSwitch$memcpy
String ID: `
API String ID: 148397844-2679148245
Opcode ID: 72cfa8fae357e983777cdee667dc493bab4156b7407fc3f752960c129d006c1e
Instruction ID: 852a0ae161cd9f473a9f2f9369466027b6d5a1bee920cd073db2ca94005120fa
Opcode Fuzzy Hash: 72cfa8fae357e983777cdee667dc493bab4156b7407fc3f752960c129d006c1e
Instruction Fuzzy Hash: 8FD1C3F060A7059FDB40AFA4D08471AFBE0AF54788F01892DE8D89B345DB75D885DBE2

Function 60047E30 Relevance: 10.6, APIs: 7, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 60046AD0: TlsAlloc.KERNEL32(?,?,00000000,6004801E,?,?,?,431BDE83,60049B07), ref: 60046B04

TlsGetValue.KERNEL32(?,?,00000000,?,60048065,?,?,?,?,431BDE83,60049B07), ref: 60047E42

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: AllocValue
String ID:
API String ID: 1189806713-0
Opcode ID: d3a238084a337564d40c246ac0e3f95bded7463efeb01f9a0e0b2b3a1659e8c4
Instruction ID: d1a2d334b42c2f4a544b62f2c294695b2870e45f0fa9a9d3d0febd8604eabdea
Opcode Fuzzy Hash: d3a238084a337564d40c246ac0e3f95bded7463efeb01f9a0e0b2b3a1659e8c4
Instruction Fuzzy Hash: 154151B2604601CBEB007FB9A98931A7FE1EF25218F110A79EC99C7256FB74D844C797

Function 600466E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6004671E
OutputDebugStringA.KERNEL32 ref: 60046743
abort.MSVCRT ref: 6004674C
fprintf.MSVCRT ref: 6004680C

Strings

5, xrefs: 60046730

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabortfprintf
String ID: 5
API String ID: 4086887302-2226203566
Opcode ID: d459a5865718238d2f7fbe79327606cb666b39bc6e16514b4ea991f053fdaf4e
Instruction ID: f2f9ed8e71adc544c9bc360fe8d00aecb24325a23b9250955a94b962e806e000
Opcode Fuzzy Hash: d459a5865718238d2f7fbe79327606cb666b39bc6e16514b4ea991f053fdaf4e
Instruction Fuzzy Hash: 26316CB1808705DBDB10AFA4C88575EBFF4BF65308F018A3DE898A7211E7749985CB97

Function 60047BB0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 60046B90: TlsGetValue.KERNEL32 ref: 60046CD0

longjmp.MSVCRT ref: 60047BE6
TlsGetValue.KERNEL32(?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE,?,?,?,00000000,?), ref: 60047BF4
CloseHandle.KERNEL32(?,?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE,?,?,?,00000000), ref: 60047C1B
_endthreadex.MSVCRT(?,?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE,?,?,?,00000000), ref: 60047C30
CloseHandle.KERNEL32(?,?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE,?,?,?,00000000), ref: 60047C42
TlsSetValue.KERNEL32(?,?,?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE), ref: 60047C63
CloseHandle.KERNEL32(?,?,?,?,0000001C,60047D9F,?,?,?,?,00000000,60047EDE,?,?,?,00000000), ref: 60047C7A

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 9c86d6b2149c48c6d51be8d3767fc7071d2f9b30ab49a656773b4bb8f026a57b
Instruction ID: 58582bccfbb437411b874a105c3b309d3c2af6d6b3cb808036a5eb248f0db648
Opcode Fuzzy Hash: 9c86d6b2149c48c6d51be8d3767fc7071d2f9b30ab49a656773b4bb8f026a57b
Instruction Fuzzy Hash: D121B7B1614600CFEB01AF74C9C871A7FE9EF29708F0149ADE988DB256E774D844CB96

Function 600EDBF0 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 600EDC07

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 2161c03ad2c57941549b9d48d64c0b99bea43c5421fe6c6eb83d5dca8902339c
Instruction ID: 6cdcb10f1c3552fcc4e54384a272d7736b3c55b74fc6961a51f2b5ef8e06bfa5
Opcode Fuzzy Hash: 2161c03ad2c57941549b9d48d64c0b99bea43c5421fe6c6eb83d5dca8902339c
Instruction Fuzzy Hash: 6E212CB0618701DFD700BF79C48632EBBE4AFA5348F41882DE4C8AB256DBB49845CB57

Function 5FD2F8F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

e, xrefs: 5FD2FB09
`, xrefs: 5FD2FB68

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID:
String ID: `$e
API String ID: 0-2074502723
Opcode ID: 93e7e029b56ea3c8790285db04b322a81804bc745df554213c2b1ce50fbed2e5
Instruction ID: 580fd6ca1cd4086cbc184499f1aeabe9a44d3b70011a4522107a954ef465bcb4
Opcode Fuzzy Hash: 93e7e029b56ea3c8790285db04b322a81804bc745df554213c2b1ce50fbed2e5
Instruction Fuzzy Hash: 1F71C8F050A3069BDB40AFA4D48475EFBE4AF90B88F01882DE4C85B345D775D484DBE2

Function 60049E70 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 60049E98
free.MSVCRT ref: 60049F27
free.MSVCRT ref: 60049F4F

Part of subcall function 600454A0: calloc.MSVCRT ref: 600454DD
Part of subcall function 600454A0: CreateSemaphoreA.KERNEL32 ref: 6004551F
Part of subcall function 600454A0: CreateSemaphoreA.KERNEL32 ref: 60045546
Part of subcall function 600454A0: InitializeCriticalSection.KERNEL32 ref: 60045565
Part of subcall function 600454A0: InitializeCriticalSection.KERNEL32 ref: 60045570
Part of subcall function 600454A0: InitializeCriticalSection.KERNEL32 ref: 6004557B

free.MSVCRT ref: 60049F97

Strings

, xrefs: 60049E89

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSectionfree$CreateSemaphorecalloc
String ID:
API String ID: 3430360044-3916222277
Opcode ID: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction ID: d4ded250f34e4fa5e7112a36214a08828a89094eb6c60d680852c7155f57a2b6
Opcode Fuzzy Hash: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction Fuzzy Hash: 6A313CB16093009FE3049F26E98435EBBE4EF94318F45887EE8888B245D376C8498B96

Function 60049A40 Relevance: 6.2, APIs: 4, Instructions: 165timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 60049A91
GetSystemTimeAsFileTime.KERNEL32 ref: 60049B28
_errno.MSVCRT ref: 60049BA7
_errno.MSVCRT ref: 60049BE2

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: 2a5565a6b818dd17143566424c6d4a71e3e1914a9d6f16c10db566cd6fc5d48e
Instruction ID: c352c323cf28550a321773786d4a6ab7db95828960cafd7b4ded453e4434505e
Opcode Fuzzy Hash: 2a5565a6b818dd17143566424c6d4a71e3e1914a9d6f16c10db566cd6fc5d48e
Instruction Fuzzy Hash: 33515572608314CFC710DF69DA8470ABBE6FFD9314F118A39E89897264E774D905CB86

Function 6004BD40 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,6004BC17), ref: 600EF810
abort.MSVCRT(?,?,?,?,?,?,6004BB6C), ref: 600EF818
abort.MSVCRT(?,?,?,?,?,?,6004BC17), ref: 600EF82C
abort.MSVCRT(?,?,?,?,?,?,6004BC17), ref: 600EF844

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3eb964297f571ce88608a88033ac70a80541a51bfd3be9cd2aa143f8ccd368a8
Instruction ID: a08a0de57c96446baa6214251d23e65cf8414dc6cfdfeb1e31835c6836ee58ae
Opcode Fuzzy Hash: 3eb964297f571ce88608a88033ac70a80541a51bfd3be9cd2aa143f8ccd368a8
Instruction Fuzzy Hash: 1441E0716482058FC700DF79D4817AE7BE5FFE2308F14896DE4849B21ADB31A806C7A6

Function 5FF9FB30 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 5FF9FB60
GetTickCount.KERNEL32 ref: 5FF9FB6D
QueryPerformanceFrequency.KERNEL32 ref: 5FF9FBD7

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: PerformanceQuery$CountCounterFrequencyTick
String ID:
API String ID: 713402817-0
Opcode ID: 84b0c35a97de3f2fd640774406fcad66310acc6e91501107c13287184f658e09
Instruction ID: 9a7511d43de46428283a1010dbc43173c746044d7e40f050a8285b4565bbcfdc
Opcode Fuzzy Hash: 84b0c35a97de3f2fd640774406fcad66310acc6e91501107c13287184f658e09
Instruction Fuzzy Hash: C43118B59083019FDB04EF34D58864ABFE0BF99318F018A29E898D7255E734E549CF52

Function 5FD7BFC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 5FD7C058
strcpy.MSVCRT(?,?,?,?,?,?,5FC9C146), ref: 5FD7C089
strlen.MSVCRT ref: 5FD7C093

Strings

B, xrefs: 5FD7C01C

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: strlen$strcpy
String ID: B
API String ID: 2790333442-1255198513
Opcode ID: 8e3183bdad4eda313744ce643a35e653959177088111f9ab80ea28d8ff94aa23
Instruction ID: ef596f1fc39dccfb92e99bcdecba9e9aaee5c03b05c0b8ed0127a494a0e6ccc2
Opcode Fuzzy Hash: 8e3183bdad4eda313744ce643a35e653959177088111f9ab80ea28d8ff94aa23
Instruction Fuzzy Hash: 81212AF580A7059FD740AF64D48439ABBE0FF81344F45486EE9C88F202EB76E5449B92

Function 600CA400 Relevance: 5.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 600CA49E
memmove.MSVCRT(?,?,?,?,?,00000000,00000000,?,?,5FC87F62), ref: 600CA4BE
memset.MSVCRT ref: 600CA5B4

Part of subcall function 600EDBF0: malloc.MSVCRT ref: 600EDC07

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: memset$mallocmemmove
String ID:
API String ID: 1346079573-0
Opcode ID: c8279bf9204a0778159bf762d9e45b4f715b2bdf2661ab89fb52134b18c99cbf
Instruction ID: a2a0261bf5d94632215dacd4ceaed8260ddc0ea81de3461f57f34d0108addc9e
Opcode Fuzzy Hash: c8279bf9204a0778159bf762d9e45b4f715b2bdf2661ab89fb52134b18c99cbf
Instruction Fuzzy Hash: CA51F5B1608702CFC309DF29D58061EFBE1AFD9754F20892EE8988B355E731D949DB92

Function 60045B50 Relevance: 5.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,?,6004A59B), ref: 60045B96
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,?,6004A59B), ref: 60045C26

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ce2bc9f63a75a81fc7534594c14dc2ce238b17ac8d798eb44db92c19587ab625
Instruction ID: acb5ea10e0d434a0b1951f0bdc5a10423303a89692aab8a347ca80ec6f286de5
Opcode Fuzzy Hash: ce2bc9f63a75a81fc7534594c14dc2ce238b17ac8d798eb44db92c19587ab625
Instruction Fuzzy Hash: A33136B5508200CFDB04EF28D8C475ABBE0EF54319F444679EC158B24AE735D984CB96

Function 60045900 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,00000030,00000050,?,60045BD1), ref: 60045920
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,00000030,00000050,?,60045BD1), ref: 6004593C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,60045BD1), ref: 60045979
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,60045BD1), ref: 60045985

Memory Dump Source

Source File: 0000000A.00000002.1861003019.000000005FC81000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FC80000, based on PE: true

Associated: 0000000A.00000002.1860982127.000000005FC80000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865458228.00000000600F9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.0000000060100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1865509119.00000000601CE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1866784872.00000000602B5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868108793.00000000602B6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868161375.00000000602B7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.1868191734.00000000602BB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5fc80000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2c68b92b020cb9a5385ba627398a1583bf2dd7a62662d921ebce27bf717ec500
Instruction ID: abb7dd834fb7c615151f5baf8b6a20f99f795afeb06130178c702e5496f75ff7
Opcode Fuzzy Hash: 2c68b92b020cb9a5385ba627398a1583bf2dd7a62662d921ebce27bf717ec500
Instruction Fuzzy Hash: 6011F5B5A083148FC700EF39E98550ABBF0EF99661F02093DE98897311D231EC58CB92

Analysis Process: rutserv.exePID: 8104, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	7

Executed Functions

Function 00EA9A60 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000000,?,00EA9B19,?,?,00EA9D58), ref: 00EA9AC6

Strings

gfff, xrefs: 00EA9AAA
gfff, xrefs: 00EA9A81

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: Sleep
String ID: gfff$gfff
API String ID: 3472027048-3084402119
Opcode ID: 6487318beef497506cce547d6419ed7a7e5fe84b49e5e6baa35296401d7428f0
Instruction ID: 390dbd6635161cd47be935e4c7885f7d943b89bac3682ae2f1855cfa1733d4aa
Opcode Fuzzy Hash: 6487318beef497506cce547d6419ed7a7e5fe84b49e5e6baa35296401d7428f0
Instruction Fuzzy Hash: 580180717045114BDB6C993DA88176C25D3F7DF301F546227E903EE2CBE975B8549243

Function 00F04F3C Relevance: 3.0, APIs: 2, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,00F050E0,00000000,00020019,?), ref: 00F04FB7
RegQueryValueExW.KERNELBASE(?,00F0513C,00000000,00000000,00000000,?,00000000,00F050CE), ref: 00F04FE5

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000F03000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f03000_rutserv.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 2ee0655bdb462ab317051598c028647db6b4e96559ed216c77c1c54fd38cce40
Instruction ID: bc0735bf2d108ee534cb0df44ba84a8652b1a034f865f82b67a730941ab3e3cd
Opcode Fuzzy Hash: 2ee0655bdb462ab317051598c028647db6b4e96559ed216c77c1c54fd38cce40
Instruction Fuzzy Hash: C2116570A40708ABD720DA658D42BDFB7E8EB05F00F1054A5FA08E6581E6B0DA40AF91

Function 013D0658 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE(0000000A,00000000), ref: 013D076A

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000013D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_13d0000_rutserv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e47b864ff4b1e634821928918225a97cd5229d42095318a228567bcc8b8c6d5d
Instruction ID: feaa5afcbbf618154584ef735e0af5116a0d8b2cef594a561c8e03adab9611f8
Opcode Fuzzy Hash: e47b864ff4b1e634821928918225a97cd5229d42095318a228567bcc8b8c6d5d
Instruction Fuzzy Hash: 89414D31A04204EFDB19DB68E581E9D7BE5FF46728F2640D5F504AF692D734AE00CB10

Function 013B1034 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(?,?), ref: 013B10E7

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000013B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_13b1000_rutserv.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: d2af988a6fd65927ee09a169361aee26c4cd193d430b74d6c10dede513374955
Instruction ID: 4021bee9e437d0f33aa579d7356e67b461390d409ed4a9281bdc75c30fa1d93c
Opcode Fuzzy Hash: d2af988a6fd65927ee09a169361aee26c4cd193d430b74d6c10dede513374955
Instruction Fuzzy Hash: 4821D270F042499FDB15CF7998A07EEBBF5AB49304F044475E904EA656F73899048B64

Function 00EAB190 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 00EAB1EA

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5e9b8c4ae29e4c043bfbe03df5a1391388585cab4babefb6f1c5df7d759cf605
Instruction ID: 2e141920cf4e37010b8d05f45b8b2b9be9b2828565c7d1082e116bbbc6adf7ca
Opcode Fuzzy Hash: 5e9b8c4ae29e4c043bfbe03df5a1391388585cab4babefb6f1c5df7d759cf605
Instruction Fuzzy Hash: FF018F72705614AFC710CF9D9884A8EBBECEB5E320F144126F518EB381D771AD008BA4

Function 00EAB18E Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 00EAB1EA

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e91e50b9487720f1f1048f51bac5a4d11cd6e302e3515caf0c220ae9aad3b8dd
Instruction ID: 224f7b8767255e1aa6c66634608806a8943a9ab198723f39f3398623bcdce393
Opcode Fuzzy Hash: e91e50b9487720f1f1048f51bac5a4d11cd6e302e3515caf0c220ae9aad3b8dd
Instruction Fuzzy Hash: 73F0A472705614AFD710CA9D9C44A9EB7ECEB5E324F104126F918EB341D771ED0087A4

Function 00FEBE64 Relevance: 1.5, APIs: 1, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00FEBE84

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000FEB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_feb000_rutserv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 557f73cfbc52fe109547301a185973879a8bb3248639e4379cc1017c11a1b59d
Instruction ID: bd54f53f8d0cdf6601f993b97b13402360fb3d742146520c579578d77c424665
Opcode Fuzzy Hash: 557f73cfbc52fe109547301a185973879a8bb3248639e4379cc1017c11a1b59d
Instruction Fuzzy Hash: 49F08C605042C09ADB21EBB5E8D17973BD91F85328F1C509AEA444F357C726E884F732

Function 00EAB734 Relevance: 1.5, APIs: 1, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysReAllocStringLen.OLEAUT32(?,?,?,00EAAE29), ref: 00EAB74E

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction ID: 9a3afd37a2eba586791afd35a1889a21c49cc9d4daa91993e4ff8ef4dc66f057
Opcode Fuzzy Hash: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction Fuzzy Hash: 8EE0C2B4100201AEEE148A148800B3B7A6EABDF306FA8F698B4127F142DBB1BC40C734

Function 00FEBF2A Relevance: 1.5, APIs: 1, Instructions: 19
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadPriority.KERNELBASE(?), ref: 00FEBF41

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000FEB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_feb000_rutserv.jbxd

Similarity

API ID: PriorityThread
String ID:
API String ID: 2383925036-0
Opcode ID: ddd3928bc7c0e502a659399cddecb23e6645192f31935691471eb34db15abbb5
Instruction ID: d43cc30d87dd7b4ec44dc4639dd1b0bd2d60795bf0bcd8976f73f20fb7e0f709
Opcode Fuzzy Hash: ddd3928bc7c0e502a659399cddecb23e6645192f31935691471eb34db15abbb5
Instruction Fuzzy Hash: 71D0227370086D2F8328E9FEAC80CBF72CDCB8C2067208423F004C3210D229CC0143A0

Function 013B1218 Relevance: 1.5, APIs: 1, Instructions: 18
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000401,?,00000000), ref: 013B1230

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000013B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_13b1000_rutserv.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction ID: f27f85ba66f206441116e2e997ccaf093cb36628d6dc211513a57b949e0c6f3d
Opcode Fuzzy Hash: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction Fuzzy Hash: D7D017B1204200AAF70096A99DCAF6177D8AB85718F4840A0BB0C9F293D2A5A8018264

Function 00EAB498 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocStringLen.OLEAUT32(?,00000000,?,00EAB5F3), ref: 00EAB4A3

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction ID: 30dc6ebcadcb3a319bf1b2060ecbc49679dc6a1ff49c9652c7bb502c06a1314e
Opcode Fuzzy Hash: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction Fuzzy Hash: BCC012B9109602AAAE092B305901A7A6FACAD5F30A79060A9B922BD012E665F8802520

Function 00EAB208 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 00EAB21D

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000EA9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea9000_rutserv.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 54ebe864998c7a93b4897758cc10db3d37890114d65228f3eff096be5897891e
Instruction ID: fd72341587e3f714e890991733dd04ec8918b1c11168273c957d39d5c298bf4b
Opcode Fuzzy Hash: 54ebe864998c7a93b4897758cc10db3d37890114d65228f3eff096be5897891e
Instruction Fuzzy Hash: 22C09BF120170447C72026B56DCC71D71985B4D305F54242572079E257C77D5C84CF54

Function 0138859C Relevance: 1.4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IdThread (unknown), xrefs: 013885B5

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001388000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01388000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1388000_rutserv.jbxd

Similarity

API ID:
String ID: IdThread (unknown)
API String ID: 0-2043411369
Opcode ID: f89ef15a01ca96bbb61efd791b0fc0445b27023a0865b538a9d51709ab7c0776
Instruction ID: bcf38c304edc0c9f79a21c468ecee9c6789e56efb078201ee7540ad1dbcc13a8
Opcode Fuzzy Hash: f89ef15a01ca96bbb61efd791b0fc0445b27023a0865b538a9d51709ab7c0776
Instruction Fuzzy Hash: C7419A30604344EFE712EF28C955959BBF9FB4A718BA248E4F900A7B61C734EE21DA50

Function 013AC710 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

loopback, xrefs: 013AC7D0

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000013AC000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_13ac000_rutserv.jbxd

Similarity

API ID:
String ID: loopback
API String ID: 0-3546420730
Opcode ID: fefc6731d317ad73994722e839c85a7b08d076bf8295685f927d2e734160ee9a
Instruction ID: d7a0caf70fdbc20087d2b00fbb6c477a9de2a50479bfe4357dc5bb500f2d3c28
Opcode Fuzzy Hash: fefc6731d317ad73994722e839c85a7b08d076bf8295685f927d2e734160ee9a
Instruction Fuzzy Hash: 54410875A10208AFDB01DF98D89199EBBF8FF4A314F9095A5F814EB622D730EE40CB50

Function 01DA67B0 Relevance: 1.3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TProcessMessagesThread.Execute, xrefs: 01DA67BE

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001DA6000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01DA6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1da6000_rutserv.jbxd

Similarity

API ID:
String ID: TProcessMessagesThread.Execute
API String ID: 0-3632000192
Opcode ID: f81df19f84a5eab16f3af7bbbf7d9dc6caf686b1ec908310f1b82717a6d48a24
Instruction ID: 75a7bfeba02b78ca2bb1ea554138e49e9c4da6f2fee85c0f9f7204cf35e47dc2
Opcode Fuzzy Hash: f81df19f84a5eab16f3af7bbbf7d9dc6caf686b1ec908310f1b82717a6d48a24
Instruction Fuzzy Hash: 59216A74A04209EFD700EFA9D981A89B7F6FB49720F6082A5F814DB7A1D735ED40DB90

Function 01183000 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001183000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01183000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1183000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675ffd105deade855efae919661d0a97c3f0e4f1d5ba0a26260af152c8aef9c2
Instruction ID: 59348ab2bc7063a7f4d406e71a4f7d5917144614e8295a8e61293879f0c3996c
Opcode Fuzzy Hash: 675ffd105deade855efae919661d0a97c3f0e4f1d5ba0a26260af152c8aef9c2
Instruction Fuzzy Hash: 0F415E34A14248EFDB09DF68D880A9DBBF2FB49B10F2585B5E815AB752D331AE41CF10

Function 016D0A74 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000016D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_16d0000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f63575e3943ed07ccc07a1b61b870ba53f518463938e38efe2b4cef2152da0
Instruction ID: 9251bfee0bc69dc3db0d5eb05439728542280ea642d3213bae3490de79713c6b
Opcode Fuzzy Hash: 69f63575e3943ed07ccc07a1b61b870ba53f518463938e38efe2b4cef2152da0
Instruction Fuzzy Hash: 3E314834A08204EFE711CF68D855FA9BBF5EB4A714F2244E5F8059B752D771AE04CA24

Function 016D0E78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000016D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_16d0000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d16b9df3d8e82a6b64d91d9337a927be35b7b4735a0f0233253de8148578753
Instruction ID: 267544aa033b11c493858bda7cb8d66b44df7df425657fc7b219fcbb6239699a
Opcode Fuzzy Hash: 0d16b9df3d8e82a6b64d91d9337a927be35b7b4735a0f0233253de8148578753
Instruction Fuzzy Hash: BD21E238A04209EFC710DF58C984D99B7F5EF4A310F2581E5E845DB361DB31AD45CB41

Function 016D0D60 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000016D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_16d0000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc270680e34071a3d532d57c251ee27544192747b3ee465b0f0fcdc4c3b3f441
Instruction ID: ee2faa5f3491dfe97edd40831d195149893ae10d3bc99f9369bc8941cdd7dce7
Opcode Fuzzy Hash: dc270680e34071a3d532d57c251ee27544192747b3ee465b0f0fcdc4c3b3f441
Instruction Fuzzy Hash: F7114C31B816818FD760EF3DC944B9ABBE4AF9A384F14445AF589CB312C731A8458791

Function 01388D2C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001388000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01388000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1388000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction ID: e5c53c338e3584f710dcc4d03db49fd662304db567986b8ff8a5437b1d4cc7d3
Opcode Fuzzy Hash: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction Fuzzy Hash: 67E02273B006402BD210F75E6C41FA67B89DBDA7A4F080132FA08CF342E5235C0543E6

Function 016D0E1A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000016D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_16d0000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b0aeb2f0055a18b9db57efd372f21c3d17425dc2eb75a14f97c98bfad9725f
Instruction ID: b8904a4fbac714bbf1163b75cf43139190dae53f8f4853e46f7d99c993ec21b5
Opcode Fuzzy Hash: d5b0aeb2f0055a18b9db57efd372f21c3d17425dc2eb75a14f97c98bfad9725f
Instruction Fuzzy Hash: 2AE08661B417536BE720A57D5DC07B755C4DB24724F480679BB85C6301C7A4CD444351

Function 0131CF30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.000000000131C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0131C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_131c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad89e4fd58f34501c90f48eb14f83c983337f468b259fb8107c8e46fe43f49b
Instruction ID: ee205fd37de537db72c990a7670d8ac24e5454c5ff176ebb891d21212f2977b5
Opcode Fuzzy Hash: 5ad89e4fd58f34501c90f48eb14f83c983337f468b259fb8107c8e46fe43f49b
Instruction Fuzzy Hash: FFB092B138C2106EB51A72515C03C7A66ADD980A11F229E1EF14064484AF825880D672

Function 0131CF18 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.000000000131C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0131C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_131c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750246992debca46c038d577058d59bcd365247a748fbddf9b08ccb5cd983294
Instruction ID: 9bb52bc57df9afa80222d9ee17e77665dfc8c54c6c293a75b24964c66f44233a
Opcode Fuzzy Hash: 750246992debca46c038d577058d59bcd365247a748fbddf9b08ccb5cd983294
Instruction Fuzzy Hash: 5FB092B138C2006EB51A76519D03C7A66ADC980A11F229A5EF14064444AF835881E6B2

Function 0131CF03 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.000000000131C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0131C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_131c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8fa3752bad77ef141bf239b4dbb481ffb2723ab08760d896f18c82bfb5423a
Instruction ID: a8e4396851a3b42c3dfa507e8fbfe2810ec32f032148409b3d699b1e7f88f398
Opcode Fuzzy Hash: 8f8fa3752bad77ef141bf239b4dbb481ffb2723ab08760d896f18c82bfb5423a
Instruction Fuzzy Hash: 57B0922120D3800ED62B23A028624A87FE08C43210B1A1ADEE1C06A1529E021082D662

Function 016D0E64 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000016D0000.00000020.00000001.01000000.0000000D.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_16d0000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction ID: 4d0077ba5c09d005fb225d897d5646f3a77ff099a7a3a6c587c4ecbf5ecf8873
Opcode Fuzzy Hash: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction Fuzzy Hash: D8C09270B00204CFDB44FF6CC9C9A423BF4AB88209B1480A4A905CB2ABE7B0CC84CB40

Function 01388C84 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001388000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01388000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1388000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction ID: 2c3053d3924d6f84bd77e491328366c431db5d9c59e7731e86b22ff571e362d9
Opcode Fuzzy Hash: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction Fuzzy Hash: 32B0123600030C77CF013E86DC01C497F1DAB50360B00C011F91C080219633A671B7D4

Function 00FE9AAA Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000FE9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fe9000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction ID: dcab931c4a539a2eadd99cff47283e157d11fd23f3196920210e5ae52d992c9a
Opcode Fuzzy Hash: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction Fuzzy Hash: 6BB001747001158F9F80DB28C688905B7E1BF8932131583E0A409CB336DA30EC85CF81

Function 01389BBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001388000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01388000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1388000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction ID: e37a22a636c647a65989cd8d042f63f4fdbce9049d2fd2c36bb86874a4dfcac3
Opcode Fuzzy Hash: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction Fuzzy Hash: C7A0223023800BCFCE00BF38C08A800F3A0FE2030C3E000E080880B020CB2AE800CF80

Non-executed Functions

Function 013AC8E8 Relevance: 15.2, Strings: 12, Instructions: 159COMMON

Download Yara Rule

Strings

font-family: Courier New, monospace;, xrefs: 013AC940
font-size: 100%;, xrefs: 013AC94A
body {, xrefs: 013AC936
font-size: 130%;, xrefs: 013AC972
h1 {, xrefs: 013AC968
background-color: #FFFFFF;, xrefs: 013AC954
textarea {, xrefs: 013AC990
<style type="text/css">, xrefs: 013AC92C
display: none;, xrefs: 013AC99A
margin: 0px 0px 0px 0px;, xrefs: 013AC97C
</title>, xrefs: 013AC922
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na, xrefs: 013AC90F

Memory Dump Source

Source File: 00000011.00000002.3577851599.00000000013AC000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013AC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_13ac000_rutserv.jbxd

Similarity

API ID:
String ID: </title>$<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na$<style type="text/css">$background-color: #FFFFFF;$body {$display: none;$font-family: Courier New, monospace;$font-size: 100%;$font-size: 130%;$h1 {$margin: 0px 0px 0px 0px;$textarea {
API String ID: 0-3743830688
Opcode ID: 8e8e836ae195940e9daba1eee2dda8589356b51cae7479284fda96184375b69a
Instruction ID: bbaea344f6381d6d1f92c8849381f91834508389ea79c10fba2feae3a4caa7d5
Opcode Fuzzy Hash: 8e8e836ae195940e9daba1eee2dda8589356b51cae7479284fda96184375b69a
Instruction Fuzzy Hash: 55412120BCA340BEC606BA935C63E8B7FB9C2A9D5DEC0771CF15471F47D5D265189288

Function 01DA615C Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

closed_by_user, xrefs: 01DA61F6
error_code, xrefs: 01DA622D
network_load, xrefs: 01DA629B
show_duration_in_sec, xrefs: 01DA6264
ra_session_id, xrefs: 01DA61B4

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000001DA6000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01DA6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1da6000_rutserv.jbxd

Similarity

API ID:
String ID: closed_by_user$error_code$network_load$ra_session_id$show_duration_in_sec
API String ID: 0-946321287
Opcode ID: 7c118d3ab9100935730ae7f2ead3cdec0a235dd96a0756df732ddbea9631925b
Instruction ID: 00b706f6a455e7187a36281df6c6da51fc04345e1c2c76c553acc93bd207e95b
Opcode Fuzzy Hash: 7c118d3ab9100935730ae7f2ead3cdec0a235dd96a0756df732ddbea9631925b
Instruction Fuzzy Hash: DC61C534A00209DFCB04DF94C9859DDBBF5FF89304FA445A5E801AB265DB70AE8ACF51

Function 00FE9594 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

INHERITED, xrefs: 00FE95A8, 00FE9621
END, xrefs: 00FE9601, 00FE965A
INLINE, xrefs: 00FE95BC, 00FE9631
OBJECT, xrefs: 00FE95D2, 00FE9611

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000FE9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fe9000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: b2a77fd7a64f8ba648c382883fe6db98128b900a9ecf84bf2da5a5cec7475054
Instruction ID: 51d8d2a2ba1306e08375e302b7a905ebafccea9cb6b70b36bac914d813feae10
Opcode Fuzzy Hash: b2a77fd7a64f8ba648c382883fe6db98128b900a9ecf84bf2da5a5cec7475054
Instruction Fuzzy Hash: A4216B7460C2C49BDB10FF6EC88169A73D19F59354B248456F9848B347CABADC42BB71

Function 00FE9593 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

INHERITED, xrefs: 00FE95A8, 00FE9621
END, xrefs: 00FE9601, 00FE965A
INLINE, xrefs: 00FE9631
OBJECT, xrefs: 00FE9611

Memory Dump Source

Source File: 00000011.00000002.3577851599.0000000000FE9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FE9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fe9000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 880549da901425c2b55bb5688e3d0ecb4ce255a8d72ce3742a54e660c2f01ef3
Instruction ID: 95c16eef6017df347181ac97e28a32ac84f5a8f560b497e99b79fee632d1a168
Opcode Fuzzy Hash: 880549da901425c2b55bb5688e3d0ecb4ce255a8d72ce3742a54e660c2f01ef3
Instruction Fuzzy Hash: D4117F3460C2C48BDB10FF6ECC8169A73D19F59354B244455F8848B347CA76DC02AB60

Analysis Process: rfusclient.exePID: 3688, Parent PID: 8104COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	4

Executed Functions

Function 0178B6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(\\.\PIPE\RManFUSServerNotify32,40000000,00000003,00000000,00000003,00000000,00000000,00000000,0178B75A), ref: 0178B6ED
CloseHandle.KERNELBASE(000000FF,0178B761), ref: 0178B752

Strings

\\.\PIPE\RManFUSServerNotify32, xrefs: 0178B6E8
Error - NotifyServer - WriteFile, xrefs: 0178B737
Error - CreateFile, xrefs: 0178B6FB

Memory Dump Source

Source File: 00000012.00000002.3575481690.000000000178B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0178B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_178b000_rfusclient.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: Error - CreateFile$Error - NotifyServer - WriteFile$\\.\PIPE\RManFUSServerNotify32
API String ID: 3498533004-2744967546
Opcode ID: d7711b5ebe6133315bb66aef465efae38586077297ecc5b353f731038915be9c
Instruction ID: 94ee1e095fe24a8feb67388c8198f6662cadfc19a63f20af622d302a66553e09
Opcode Fuzzy Hash: d7711b5ebe6133315bb66aef465efae38586077297ecc5b353f731038915be9c
Instruction Fuzzy Hash: 8B11A170A80304BFE721FBE9DC52B5DB7F8EB49B10F2045A2FA10D7681D6745A009B61

Function 0120383C Relevance: 1.6, APIs: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 0120392F

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001203000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01203000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1203000_rfusclient.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction ID: 8a47f63fe519463e1c1c0db6188fadf74a6c1692e6caaae940c1e359401c1289
Opcode Fuzzy Hash: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction Fuzzy Hash: 8F2126207243062FFB33E92D0C46F7AAA9A6F93F64F144259F6C0971C3CA9A94064262

Function 00F5AF00 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00001EC8,00000000,?,?), ref: 00F5AF5A

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000000F59000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f59000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5f264b4e1e8430116800991fb07f92f7cafac2e05aeb0b082728c433190a76cb
Instruction ID: 8f2e88961dc3dd0b193018ff8e3f5c4c8018a0b07de77fd3937fb0015bcc4f86
Opcode Fuzzy Hash: 5f264b4e1e8430116800991fb07f92f7cafac2e05aeb0b082728c433190a76cb
Instruction Fuzzy Hash: 51018F72B04214AFC710DA9DA880A8ABBECAB58362F108126FA18DB381D674DD0497A1

Function 00F5AEFE Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00001EC8,00000000,?,?), ref: 00F5AF5A

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000000F59000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f59000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d0a3cd1c0602314dd9f562361558043f6cc88cfa6ea68eeb506d182cbc0a14d9
Instruction ID: 8c3098be42c811a381dcdef7e3d5e983725d7ef854891580db4df53f9f7eaa7c
Opcode Fuzzy Hash: d0a3cd1c0602314dd9f562361558043f6cc88cfa6ea68eeb506d182cbc0a14d9
Instruction Fuzzy Hash: 4FF0C272B04214AFC710CA9DAC80E9ABBECDB18372F108226FE08D7380D771DD0497A4

Function 012034A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 012034D1

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001203000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01203000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1203000_rfusclient.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction ID: 91f625c443ec7219d0839a62da8bfee9d27f33ae50ce27fcc4c5c14940964ab1
Opcode Fuzzy Hash: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction Fuzzy Hash: 84F0A7247001101FEB13EA1C88C5BEB36D8AF89605F0C01B1FF088F287C7694C459361

Function 00F5AF78 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 00F5AF8D

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000000F59000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F59000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f59000_rfusclient.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 263846a5434938c6b73e3deca2a508e593e34cfd321bb705ba64a8eba1d0ddb4
Instruction ID: 627a72d6f9be152372750e0f5ca49d60c183840a6b7829ae5d0147f714c595e2
Opcode Fuzzy Hash: 263846a5434938c6b73e3deca2a508e593e34cfd321bb705ba64a8eba1d0ddb4
Instruction Fuzzy Hash: 84C048A12002008BC3302BBAACC8F1A76B86748226F045968B70796166C7BC8898E710

Function 0178B75F Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(000000FF,0178B761), ref: 0178B752

Memory Dump Source

Source File: 00000012.00000002.3575481690.000000000178B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0178B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_178b000_rfusclient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction ID: f51748d37e50349a2c52aa7ce8dd743a1bf9b300b8478913409cadb5c7b5dbc2
Opcode Fuzzy Hash: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction Fuzzy Hash: 31A00266988307FE8A55F7E49D5686DB3685A0C3A573C1C82F223D7102C63C9AC0AA30

Function 01093DBC Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001093000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01093000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1093000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bbe366cccd2161e889e9b2acc80e4e6bcf4696cc7eb0d80c454e699ecb87c6
Instruction ID: 00f852f14800b220c0d0d213fa57dadab201766525c0abe0adeb85297720f8fb
Opcode Fuzzy Hash: 64bbe366cccd2161e889e9b2acc80e4e6bcf4696cc7eb0d80c454e699ecb87c6
Instruction Fuzzy Hash: 2C31D470904744AEDB21EBB5CC617AB7BE4BF09300F048869E9A5CF2C1DB789548EB91

Function 01093C26 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001093000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01093000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1093000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8803b3f2e17c7b2a3706b8f464595b889904ed2afb9819fbc810a3973749e997
Instruction ID: 24421d7444aa83b4d9db0de51430006c839cb47a0c351e9e454721bc982de56b
Opcode Fuzzy Hash: 8803b3f2e17c7b2a3706b8f464595b889904ed2afb9819fbc810a3973749e997
Instruction Fuzzy Hash: E6118E74608A88EFDB01CF66C92495DBBF4FB4A710B6244E4F8409B711C734AE00EF60

Function 01093C28 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001093000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01093000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1093000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db948cbde0ac0f764354740d6ed9b926df8c55f359523743b6cc66541d6c4f3b
Instruction ID: a55c0db72ea9086063950a38eb7c3f3fa453cea6fefb57c175b76caa11e33663
Opcode Fuzzy Hash: db948cbde0ac0f764354740d6ed9b926df8c55f359523743b6cc66541d6c4f3b
Instruction Fuzzy Hash: 07115E74608A88EFDB05DF66C96595DBBF4FB4A710B6244E5F8409B711C734AE00EF60

Function 01093D20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3575481690.0000000001093000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01093000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1093000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction ID: 413c524b411b0eeceea1598cb0c03f36865f4b7b326c5a713158ff700c81836f
Opcode Fuzzy Hash: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction Fuzzy Hash: 59D02B0270341083D610737C3C627D579845F459A2F080131FE90CF394EA0A0C0931D5

Function 013ABD5C Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3575481690.00000000013AB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 013AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_13ab000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fb02be8f19407d33631b912c2f132f6bad002577eb2b62ae4f95989428bd86
Instruction ID: ec7137e870f72cc4b1f18e0ddc7f761abc9e408a4a92f5cad41ba9c36b67a64f
Opcode Fuzzy Hash: 65fb02be8f19407d33631b912c2f132f6bad002577eb2b62ae4f95989428bd86
Instruction Fuzzy Hash: FEB014D154C7047D750755115D4FC75735CC7C0715FD4451DF041C5544DD4515417477

Function 013ABD74 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3575481690.00000000013AB000.00000020.00000001.01000000.0000000B.sdmp, Offset: 013AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_13ab000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d725e79a481c8a1db167ee52a6bc5a45880010055fd71e071b60981474e3fe
Instruction ID: bb07b33412064f352a5767188b0191bb339b132a1272c6fe5275e44c3c086b41
Opcode Fuzzy Hash: 39d725e79a481c8a1db167ee52a6bc5a45880010055fd71e071b60981474e3fe
Instruction Fuzzy Hash: A3B09BD555C6046D750755115C4BC7562DCD6C1755F54451EF041C5544AD4415407476

Analysis Process: rfusclient.exePID: 2416, Parent PID: 8104COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01435E68 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(01435F28,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,01435F1A), ref: 01435E9C

Memory Dump Source

Source File: 00000013.00000002.3576444228.0000000001435000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01435000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1435000_rfusclient.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 270fc3a48004f24598599c0591c0e0f2675d5f408731cb192865a8d8e11d3ae0
Instruction ID: 65f17b3361beefa34d221bea66554a37aab1f11706117585065c8f915c3962c5
Opcode Fuzzy Hash: 270fc3a48004f24598599c0591c0e0f2675d5f408731cb192865a8d8e11d3ae0
Instruction Fuzzy Hash: 7C112530648304FFE7219BA8DC17F597BB4E78DB30F314696F610AA6E0DA742940D625

Function 01267F48 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3576444228.0000000001267000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01267000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1267000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107bad640b21804a5c345d59172d482a89b53379da635a18bc6c09d6bb13b275
Instruction ID: 74215126cffe109c588f2f4efad2610fedbb02fbefc31936494d9d3a7d517efb
Opcode Fuzzy Hash: 107bad640b21804a5c345d59172d482a89b53379da635a18bc6c09d6bb13b275
Instruction Fuzzy Hash: 9B114934610304EFD711CF68C995F69BBF9EB0A700F2248E4E904977A2D775AD90EA21

Function 012678B8 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.3576444228.0000000001267000.00000020.00000001.01000000.0000000B.sdmp, Offset: 01267000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1267000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction ID: e88ecd783f97c0105e5e91a891ff402331555bdcad27e279c66b8fe3d8a2bda2
Opcode Fuzzy Hash: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction Fuzzy Hash: A9B0123200010C778F013F81FC00C897F1DAB20260B00C011F9480802086339571B794

Input	Output
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": " ", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": "Got it", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " . \" \"", "prominent_button_name": " ", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 442.docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3c2b92.rbs

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Windows Analysis Report
442.docx.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre